Edit tour

Windows Analysis Report
f86nrrc6.exe

Overview

General Information

Sample name:	f86nrrc6.exe
Analysis ID:	1577529
MD5:	f2a50f1b081ea3cd4821195676adacf1
SHA1:	f57f61d9e455b0a30399dd36d97234bb6fd12802
SHA256:	9446296c74c2843600e6dccb68316ba93494c7eca4053de766bd237a0ff37279
Tags:	18521511316185215113209bulletproofexeLummaStealeruser-abus3reports
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to record screenshots

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

f86nrrc6.exe (PID: 7708 cmdline: "C:\Users\user\Desktop\f86nrrc6.exe" MD5: F2A50F1B081EA3CD4821195676ADACF1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["nightybinybz.shop", "mutterissuen.shop", "worddosofrm.shop", "moutheventushz.shop", "bakedstusteeb.shop", "conceszustyb.shop", "respectabosiz.shop", "standartedby.shop"], "Build id": "4SD0y4--MAGISTER"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:59.675990+0100	2028371	3	Unknown Traffic	192.168.2.7	49713	104.102.49.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bakedstusteeb .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:57.110441+0100	2057261	1	Domain Observed Used for C2 Detected	192.168.2.7	51130	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conceszustyb .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:56.877818+0100	2057259	1	Domain Observed Used for C2 Detected	192.168.2.7	56562	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moutheventushz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:57.649988+0100	2057255	1	Domain Observed Used for C2 Detected	192.168.2.7	52122	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterissuen .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:56.207282+0100	2057267	1	Domain Observed Used for C2 Detected	192.168.2.7	58173	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nightybinybz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:56.648865+0100	2057263	1	Domain Observed Used for C2 Detected	192.168.2.7	54338	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (respectabosiz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:55.695291+0100	2057257	1	Domain Observed Used for C2 Detected	192.168.2.7	59373	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (standartedby .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:56.430437+0100	2057265	1	Domain Observed Used for C2 Detected	192.168.2.7	53191	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (worddosofrm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:07:55.986130+0100	2057269	1	Domain Observed Used for C2 Detected	192.168.2.7	56157	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:08:00.464093+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	49713	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.f86nrrc6.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["nightybinybz.shop", "mutterissuen.shop", "worddosofrm.shop", "moutheventushz.shop", "bakedstusteeb.shop", "conceszustyb.shop", "respectabosiz.shop", "standartedby.shop"], "Build id": "4SD0y4--MAGISTER"}

Multi AV Scanner detection for submitted file

Source: f86nrrc6.exe

ReversingLabs: Detection: 71%

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: moutheventushz.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: respectabosiz.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: bakedstusteeb.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: conceszustyb.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: nightybinybz.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: standartedby.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: mutterissuen.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: worddosofrm.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: respectabosiz.shop
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String decryptor: 4SD0y4--MAGISTER

Source: f86nrrc6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49713 version: TLS 1.2

Source:

Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: f86nrrc6.exe, f86nrrc6.exe, 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmp

Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+08h]	4_2_0040FF28
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then jmp eax	4_2_00424C70
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then jmp ecx	4_2_0041102F
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx ebp, word ptr [eax]	4_2_0043FCC0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then mov esi, eax	4_2_004358F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	4_2_0043F880
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then mov edx, ecx	4_2_0040F0B0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_00428140
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	4_2_00404D50
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	4_2_00408960
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+44D9AB7Fh]	4_2_00423DD0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 33079CCDh	4_2_0043F9D0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	4_2_00405DE0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then mov ebp, eax	4_2_0040A5F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000EBh]	4_2_00438580
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then jmp ecx	4_2_00411DB0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	4_2_00407210
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+5E07836Bh]	4_2_0041DAD0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	4_2_004266F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then mov ebp, edx	4_2_004266F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h	4_2_00436350
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9ABDB589h	4_2_00438330
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], C0A4C970h	4_2_00440330
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9ABDB589h	4_2_004247C0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 9ABDB589h	4_2_004247C0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057259 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conceszustyb .shop) : 192.168.2.7:56562 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057263 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nightybinybz .shop) : 192.168.2.7:54338 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057267 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterissuen .shop) : 192.168.2.7:58173 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057255 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moutheventushz .shop) : 192.168.2.7:52122 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057257 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (respectabosiz .shop) : 192.168.2.7:59373 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057269 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (worddosofrm .shop) : 192.168.2.7:56157 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057261 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bakedstusteeb .shop) : 192.168.2.7:51130 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057265 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (standartedby .shop) : 192.168.2.7:53191 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49713 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: nightybinybz.shop
Source: Malware configuration extractor	URLs: mutterissuen.shop
Source: Malware configuration extractor	URLs: worddosofrm.shop
Source: Malware configuration extractor	URLs: moutheventushz.shop
Source: Malware configuration extractor	URLs: bakedstusteeb.shop
Source: Malware configuration extractor	URLs: conceszustyb.shop
Source: Malware configuration extractor	URLs: respectabosiz.shop
Source: Malware configuration extractor	URLs: standartedby.shop

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49713 -> 104.102.49.254:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: f86nrrc6.exe, 00000004.00000003.1444788375.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=fb63f22e2ee3a484412bc217; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 18 Dec 2024 14:08:00 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: respectabosiz.shop
Source: global traffic	DNS traffic detected: DNS query: worddosofrm.shop
Source: global traffic	DNS traffic detected: DNS query: mutterissuen.shop
Source: global traffic	DNS traffic detected: DNS query: standartedby.shop
Source: global traffic	DNS traffic detected: DNS query: nightybinybz.shop
Source: global traffic	DNS traffic detected: DNS query: conceszustyb.shop
Source: global traffic	DNS traffic detected: DNS query: bakedstusteeb.shop
Source: global traffic	DNS traffic detected: DNS query: moutheventushz.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: f86nrrc6.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: f86nrrc6.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: f86nrrc6.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: f86nrrc6.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: f86nrrc6.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: f86nrrc6.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1445024997.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014C3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1447051697.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446981599.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1445024997.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: f86nrrc6.exe, 00000004.00000002.1447051697.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1447167203.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444788375.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: f86nrrc6.exe, 00000004.00000002.1447051697.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shopU
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\f86nrrc6.exe

Code function: 4_2_00430A30 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

4_2_00430A30

Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040F560	4_2_0040F560
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040805C	4_2_0040805C
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00409C61	4_2_00409C61
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040A070	4_2_0040A070
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00424C70	4_2_00424C70
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0043FCC0	4_2_0043FCC0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_004358F0	4_2_004358F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00436490	4_2_00436490
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040F0B0	4_2_0040F0B0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00434D40	4_2_00434D40
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00408960	4_2_00408960
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040C170	4_2_0040C170
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00413D2B	4_2_00413D2B
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00405530	4_2_00405530
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040B1D0	4_2_0040B1D0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00423DD0	4_2_00423DD0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0043F9D0	4_2_0043F9D0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0043E5E0	4_2_0043E5E0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040A5F0	4_2_0040A5F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0041FDF0	4_2_0041FDF0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_004039B0	4_2_004039B0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040DA20	4_2_0040DA20
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0041D220	4_2_0041D220
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040A228	4_2_0040A228
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_004266F0	4_2_004266F0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040DE80	4_2_0040DE80
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00421A80	4_2_00421A80
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040AB40	4_2_0040AB40
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00409340	4_2_00409340
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00414763	4_2_00414763
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00428B00	4_2_00428B00
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00412322	4_2_00412322
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00440330	4_2_00440330
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_004247C0	4_2_004247C0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00411FD0	4_2_00411FD0
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00434FA0	4_2_00434FA0

Source: f86nrrc6.exe

Static PE information: invalid certificate

Source: f86nrrc6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\f86nrrc6.exe

Code function: 4_2_004358F0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,

4_2_004358F0

Source: C:\Users\user\Desktop\f86nrrc6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: f86nrrc6.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\f86nrrc6.exe

File read: C:\Users\user\Desktop\f86nrrc6.exe

Jump to behavior

Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Section loaded: dpapi.dll	Jump to behavior

Source: f86nrrc6.exe

Static file information: File size 7238808 > 1048576

Source: f86nrrc6.exe

Static PE information: Raw size of .MPRESS1 is bigger than: 0x100000 < 0x69aa00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\f86nrrc6.exe

Unpacked PE file: 4.2.f86nrrc6.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: f86nrrc6.exe	Static PE information: section name: .MPRESS1
Source: f86nrrc6.exe	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_0040196B push esi; ret		4_2_00401972
Source: C:\Users\user\Desktop\f86nrrc6.exe	Code function: 4_2_00403937 push esi; ret		4_2_00403939

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\f86nrrc6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Window searched: window name: RegmonClass	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 12A0005 value: E9 2B BA 48 76	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 7772BA30 value: E9 DA 45 B7 89	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 12B0008 value: E9 8B 8E 4C 76	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 77778E90 value: E9 80 71 B3 89	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 1410005 value: E9 8B 4D 62 74	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 75A34D90 value: E9 7A B2 9D 8B	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 1430005 value: E9 EB EB 61 74	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 75A4EBF0 value: E9 1A 14 9E 8B	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 1440005 value: E9 8B 8A 19 75	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 765D8A90 value: E9 7A 75 E6 8A	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 1450005 value: E9 2B 02 1B 75	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Memory written: PID: 7708 base: 76600230 value: E9 DA FD E4 8A	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\f86nrrc6.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\f86nrrc6.exe	API/Special instruction interceptor: Address: 106D1AC
Source: C:\Users\user\Desktop\f86nrrc6.exe	API/Special instruction interceptor: Address: FB74B6
Source: C:\Users\user\Desktop\f86nrrc6.exe	API/Special instruction interceptor: Address: F0664A
Source: C:\Users\user\Desktop\f86nrrc6.exe	API/Special instruction interceptor: Address: EBEAB3

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\f86nrrc6.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\f86nrrc6.exe

Special instruction interceptor: First address: 55BE1A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\f86nrrc6.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\f86nrrc6.exe

API coverage: 6.7 %

Source: C:\Users\user\Desktop\f86nrrc6.exe TID: 7940	Thread sleep time: -90000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe TID: 7944	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: f86nrrc6.exe	Binary or memory string: qo(cQeMU
Source: f86nrrc6.exe, 00000004.00000002.1447051697.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2J
Source: f86nrrc6.exe, 00000004.00000002.1447051697.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\f86nrrc6.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\f86nrrc6.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\f86nrrc6.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\f86nrrc6.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\f86nrrc6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f86nrrc6.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\f86nrrc6.exe

Code function: 4_2_0043B600 LdrInitializeThunk,

4_2_0043B600

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: f86nrrc6.exe	String found in binary or memory: moutheventushz.shop
Source: f86nrrc6.exe	String found in binary or memory: respectabosiz.shop
Source: f86nrrc6.exe	String found in binary or memory: bakedstusteeb.shop
Source: f86nrrc6.exe	String found in binary or memory: conceszustyb.shop
Source: f86nrrc6.exe	String found in binary or memory: nightybinybz.shop
Source: f86nrrc6.exe	String found in binary or memory: standartedby.shop
Source: f86nrrc6.exe	String found in binary or memory: mutterissuen.shop
Source: f86nrrc6.exe	String found in binary or memory: worddosofrm.shop

Source: C:\Users\user\Desktop\f86nrrc6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	1 Credential API Hooking	721 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	33 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Credential API Hooking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f86nrrc6.exe	71%	ReversingLabs	Win32.Trojan.Lumma

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
nightybinybz.shop	unknown	unknown	true	unknown
moutheventushz.shop	unknown	unknown	true	unknown
standartedby.shop	unknown	unknown	true	unknown
respectabosiz.shop	unknown	unknown	true	unknown
conceszustyb.shop	unknown	unknown	true	unknown
bakedstusteeb.shop	unknown	unknown	false	high
mutterissuen.shop	unknown	unknown	true	unknown
worddosofrm.shop	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
bakedstusteeb.shop	false	high
nightybinybz.shop	false	high
moutheventushz.shop	false	high
respectabosiz.shop	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
standartedby.shop	false	high
worddosofrm.shop	false	high
conceszustyb.shop	false	high
mutterissuen.shop	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://steamcommunity.com/my/wishlist/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://player.vimeo.com	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	f86nrrc6.exe	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.sectigo.com0	f86nrrc6.exe	false	high
https://steamcommunity.com/?subsection=broadcasts	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	f86nrrc6.exe	false	high
https://store.steampowered.com/stats/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shopU	f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	f86nrrc6.exe, 00000004.00000002.1447051697.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	f86nrrc6.exe	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sectigo.com/CPS0	f86nrrc6.exe	false	high
http://store.steampowered.com/privacy_agreement/	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/	f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1:27060	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	f86nrrc6.exe	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.steampowered.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/account/cookiepreferences/	f86nrrc6.exe, 00000004.00000003.1444440878.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/mobile	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/	f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1445024997.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444932991.000000000149E000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1446963076.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	f86nrrc6.exe, 00000004.00000002.1447051697.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000002.1447167203.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444440878.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444788375.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444814594.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	f86nrrc6.exe, 00000004.00000003.1444379332.0000000001531000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444913659.0000000001535000.00000004.00000020.00020000.00000000.sdmp, f86nrrc6.exe, 00000004.00000003.1444379332.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577529
Start date and time:	2024-12-18 15:06:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f86nrrc6.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: f86nrrc6.exe

Simulations

Behavior and APIs

Time	Type	Description
09:07:54	API Interceptor	6x Sleep call for process: f86nrrc6.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	23.57.90.154
	http://www.mynylgbs.com	Get hash	malicious	Unknown	Browse	104.121.2.245
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	23.203.88.6
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	96.24.75.93
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	95.100.135.24
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.82.71.158
	arm.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	104.89.110.164
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	23.199.141.123
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	2.16.80.27
	https://garfieldthecat.tech/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	23.217.172.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.102.49.254
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ScreenUpdateSync.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	random.exe.10.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254

File type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Entropy (8bit):	7.965206863566108
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f86nrrc6.exe
File size:	7'238'808 bytes
MD5:	f2a50f1b081ea3cd4821195676adacf1
SHA1:	f57f61d9e455b0a30399dd36d97234bb6fd12802
SHA256:	9446296c74c2843600e6dccb68316ba93494c7eca4053de766bd237a0ff37279
SHA512:	b057bedb7067d3ca91f31152bbf34126cad8d29437b83656118ea5807b4f195a3270a0578f51cb8c961b9212c31c71b758865a1cf74c5b4e0bd99a5ddd2b9a58
SSDEEP:	98304:ISTkuyh2weEjW9a3JXwPhxAL+ikiYDCsPtWgYGI+4IPF6scqr/Api3RixLe7J:IP2D/83iiW2AtWxbm5ApiYxLe7J
TLSH:	30763353B650E962F92644B10D72C6B310C5FC499F2085AB71E4BF5F3830BA2C5BAD6E
File Content Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....3%g..........................................@.................................s.n..................................................%............m....................................

File Icon


Icon Hash:	23f7e7f7f3a9d8f9

Static PE Info

General

Entrypoint:	0x11181af
Entrypoint Section:	.MPRESS2
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x67253391 [Fri Nov 1 20:01:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a4ee7039994118d7b3bfbdda3544c529

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	26/09/2024 13:26:30 27/09/2034 13:26:30
Subject Chain	CN=\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\u2116\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae\xae
Version:	3
Thumbprint MD5:	831EB4B726CD805171AB232FFF74BEA8
Thumbprint SHA-1:	12E28DDFBBFB19CD577295C60487D94C803AE134
Thumbprint SHA-256:	BEB2F607C9CAE270331FEE6340CF406C0D55EEF2EC7FA075E7489CF898872E1A
Serial:	4840E0ACC336EAA44231DFA5F426BF8F

Entrypoint Preview

Instruction
pushad
call 00007FA1D11DD915h
pop eax
add eax, 00000B5Ah
mov esi, dword ptr [eax]
add esi, eax
sub eax, eax
mov edi, esi
lodsw
shl eax, 0Ch
mov ecx, eax
push eax
lodsd
sub ecx, eax
add esi, ecx
mov ecx, eax
push edi
push ecx
dec ecx
mov al, byte ptr [ecx+edi+06h]
mov byte ptr [ecx+esi], al
jne 00007FA1D11DD908h
sub eax, eax
lodsb
mov ecx, eax
and cl, FFFFFFF0h
and al, 0Fh
shl ecx, 0Ch
mov ch, al
lodsb
or ecx, eax
push ecx
add cl, ch
mov ebp, FFFFFD00h
shl ebp, cl
pop ecx
pop eax
mov ebx, esp
lea esp, dword ptr [esp+ebp*2-00000E70h]
push ecx
sub ecx, ecx
push ecx
push ecx
mov ecx, esp
push ecx
mov dx, word ptr [edi]
shl edx, 0Ch
push edx
push edi
add ecx, 04h
push ecx
push eax
add ecx, 04h
push esi
push ecx
call 00007FA1D11DD973h
mov esp, ebx
pop esi
pop edx
sub eax, eax
mov dword ptr [edx+esi], eax
mov ah, 10h
sub edx, eax
sub ecx, ecx
cmp ecx, edx
jnc 00007FA1D11DD938h
mov ebx, ecx
lodsb
inc ecx
and al, FEh
cmp al, E8h
jne 00007FA1D11DD904h
inc ebx
add ecx, 04h
lodsd
or eax, eax
js 00007FA1D11DD918h
cmp eax, edx
jnc 00007FA1D11DD8F7h
jmp 00007FA1D11DD918h
add eax, ebx
js 00007FA1D11DD8F1h
add eax, edx
sub eax, ebx
mov dword ptr [esi-04h], eax
jmp 00007FA1D11DD8E8h
call 00007FA1D11DD915h
pop edi
add edi, FFFFFF4Dh
mov al, E9h
stosb
mov eax, 00000B56h
stosd
call 00007FA1D11DD915h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd18000	0x1b0	.MPRESS2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd19000	0x4259c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6de000	0x9498	.MPRESS1
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd180b4	0x30	.MPRESS2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.MPRESS1	0x1000	0xd17000	0x69aa00	e117de0f1256fe3665f942812114b350	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.MPRESS2	0xd18000	0xd19	0xe00	15de060f77f0f2cbc3d456711626c243	False	0.5424107142857143	data	5.752343724847905	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd19000	0x4259c	0x42600	cbd7afe499608cf8356bca4d7c57f86f	False	0.2385276895009416	data	4.250171677922003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd19368	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.6292213883677298
RT_ICON	0xd1a438	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.5646265560165975
RT_ICON	0xd1ca08	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.5298771846953235
RT_ICON	0xd20c58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3135245901639344
RT_ICON	0xd21608	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.3784883720930233
RT_ICON	0xd21ce8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.42021276595744683
RT_ICON	0xd22178	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2967213114754098
RT_ICON	0xd22b28	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.35872093023255813
RT_ICON	0xd23208	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.38652482269503546
RT_ICON	0xd23698	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3237704918032787
RT_ICON	0xd24048	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.3930232558139535
RT_ICON	0xd24728	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.43617021276595747
RT_ICON	0xd24bb8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2819672131147541
RT_ICON	0xd25568	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.34011627906976744
RT_ICON	0xd25c48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.37677304964539005
RT_ICON	0xd260d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2069672131147541
RT_ICON	0xd26a88	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.24941860465116278
RT_ICON	0xd27168	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3067375886524823
RT_ICON	0xd275f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.27827868852459015
RT_ICON	0xd27fa8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.3377906976744186
RT_ICON	0xd28688	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.36879432624113473
RT_ICON	0xd28b18	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.2594262295081967
RT_ICON	0xd294c8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.30930232558139537
RT_ICON	0xd29ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.33865248226950356
RT_ICON	0xd2a038	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.28688524590163933
RT_ICON	0xd2a9e8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.34069767441860466
RT_ICON	0xd2b0c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.38475177304964536
RT_ICON	0xd2b558	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.18688524590163935
RT_ICON	0xd2bf08	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.20988372093023255
RT_ICON	0xd2c5e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2473404255319149
RT_ICON	0xd2ca78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.18688524590163935
RT_ICON	0xd2d428	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.20988372093023255
RT_ICON	0xd2db08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2473404255319149
RT_ICON	0xd2df98	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.11762295081967213
RT_ICON	0xd2e948	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.14593023255813953
RT_ICON	0xd2f028	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.17375886524822695
RT_ICON	0xd2f4b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.11762295081967213
RT_ICON	0xd2fe68	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.14593023255813953
RT_ICON	0xd30548	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.17375886524822695
RT_ICON	0xd309d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1864754098360656
RT_ICON	0xd31388	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.21104651162790697
RT_ICON	0xd31a68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25177304964539005
RT_ICON	0xd31ef8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.18278688524590164
RT_ICON	0xd328a8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.2052325581395349
RT_ICON	0xd32f88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.24113475177304963
RT_ICON	0xd33418	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.18278688524590164
RT_ICON	0xd33dc8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.2052325581395349
RT_ICON	0xd344a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.24113475177304963
RT_ICON	0xd34938	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.11147540983606558
RT_ICON	0xd352e8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.14302325581395348
RT_ICON	0xd359c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.16578014184397163
RT_ICON	0xd35e58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.11147540983606558
RT_ICON	0xd36808	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.14302325581395348
RT_ICON	0xd36ee8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.16578014184397163
RT_ICON	0xd37378	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1831967213114754
RT_ICON	0xd37d28	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.2058139534883721
RT_ICON	0xd38408	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.24468085106382978
RT_ICON	0xd38898	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1987704918032787
RT_ICON	0xd39248	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.23837209302325582
RT_ICON	0xd39928	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25975177304964536
RT_ICON	0xd39db8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1987704918032787
RT_ICON	0xd3a768	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.23837209302325582
RT_ICON	0xd3ae48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25975177304964536
RT_ICON	0xd3b2d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.12581967213114753
RT_ICON	0xd3bc88	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.15232558139534882
RT_ICON	0xd3c368	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.17819148936170212
RT_ICON	0xd3c7f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.12581967213114753
RT_ICON	0xd3d1a8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.15232558139534882
RT_ICON	0xd3d888	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.17819148936170212
RT_ICON	0xd3dd18	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1987704918032787
RT_ICON	0xd3e6c8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.2377906976744186
RT_ICON	0xd3eda8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2632978723404255
RT_ICON	0xd3f238	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.19549180327868854
RT_ICON	0xd3fbe8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.23488372093023255
RT_ICON	0xd402c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25620567375886527
RT_ICON	0xd40758	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.19549180327868854
RT_ICON	0xd41108	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.23488372093023255
RT_ICON	0xd417e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25620567375886527
RT_ICON	0xd41c78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1221311475409836
RT_ICON	0xd42628	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.1494186046511628
RT_ICON	0xd42d08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.1702127659574468
RT_ICON	0xd43198	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1221311475409836
RT_ICON	0xd43b48	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.1494186046511628
RT_ICON	0xd44228	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.1702127659574468
RT_ICON	0xd446b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1959016393442623
RT_ICON	0xd45068	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.23604651162790696
RT_ICON	0xd45748	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25975177304964536
RT_ICON	0xd45bd8	0xa48	Device independent bitmap graphic, 26 x 48 x 32, image size 0	English	United States	0.04635258358662614
RT_ICON	0xd46648	0x708	Device independent bitmap graphic, 21 x 40 x 32, image size 0	English	United States	0.06
RT_ICON	0xd46d78	0x4a8	Device independent bitmap graphic, 17 x 32 x 32, image size 0	English	United States	0.07718120805369127
RT_ICON	0xd47248	0xa48	Device independent bitmap graphic, 26 x 48 x 32, image size 0	English	United States	0.1344984802431611
RT_ICON	0xd47cb8	0x708	Device independent bitmap graphic, 21 x 40 x 32, image size 0	English	United States	0.17722222222222223
RT_ICON	0xd483e8	0x4a8	Device independent bitmap graphic, 17 x 32 x 32, image size 0	English	United States	0.21308724832214765
RT_ICON	0xd488b8	0xa48	Device independent bitmap graphic, 26 x 48 x 32, image size 0	English	United States	0.16299392097264437
RT_ICON	0xd49328	0x708	Device independent bitmap graphic, 21 x 40 x 32, image size 0	English	United States	0.20944444444444443
RT_ICON	0xd49a58	0x4a8	Device independent bitmap graphic, 17 x 32 x 32, image size 0	English	United States	0.21476510067114093
RT_ICON	0xd49f28	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.4630160889624985
RT_GROUP_ICON	0xd5a888	0x3e	data	English	United States	0.8225806451612904
RT_GROUP_ICON	0xd5a8f0	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5a948	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5a9a0	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5a9f8	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5aa50	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5aaa8	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ab00	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ab58	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5abb0	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ac08	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0xd5ac60	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5acb8	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ad10	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ad68	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5adc0	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ae18	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5ae70	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5aec8	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5af20	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5af78	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5afd0	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b028	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b080	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b0d8	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b130	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b188	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b1e0	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b238	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b290	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b2e8	0x30	data	English	United States	0.9583333333333334
RT_GROUP_ICON	0xd5b340	0x30	data	English	United States	0.9583333333333334
RT_MANIFEST	0xd5b3b0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
KERNEL32.DLL	GetModuleHandleA, GetProcAddress
USER32.dll	CloseClipboard
GDI32.dll	BitBlt
ole32.dll	CoCreateInstance
SHELL32.dll	SHEmptyRecycleBinW
OLEAUT32.dll	SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T15:07:55.695291+0100	2057257	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (respectabosiz .shop)	1	192.168.2.7	59373	1.1.1.1	53	UDP
2024-12-18T15:07:55.986130+0100	2057269	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (worddosofrm .shop)	1	192.168.2.7	56157	1.1.1.1	53	UDP
2024-12-18T15:07:56.207282+0100	2057267	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterissuen .shop)	1	192.168.2.7	58173	1.1.1.1	53	UDP
2024-12-18T15:07:56.430437+0100	2057265	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (standartedby .shop)	1	192.168.2.7	53191	1.1.1.1	53	UDP
2024-12-18T15:07:56.648865+0100	2057263	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nightybinybz .shop)	1	192.168.2.7	54338	1.1.1.1	53	UDP
2024-12-18T15:07:56.877818+0100	2057259	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conceszustyb .shop)	1	192.168.2.7	56562	1.1.1.1	53	UDP
2024-12-18T15:07:57.110441+0100	2057261	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bakedstusteeb .shop)	1	192.168.2.7	51130	1.1.1.1	53	UDP
2024-12-18T15:07:57.649988+0100	2057255	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moutheventushz .shop)	1	192.168.2.7	52122	1.1.1.1	53	UDP
2024-12-18T15:07:59.675990+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49713	104.102.49.254	443	TCP
2024-12-18T15:08:00.464093+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	49713	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:07:58.182627916 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:58.182673931 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:07:58.182742119 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:58.188236952 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:58.188261032 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:07:59.675820112 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:07:59.675990105 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:59.678869963 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:59.678881884 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:07:59.679184914 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:07:59.730422020 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:59.772269011 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:07:59.815342903 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464144945 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464165926 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464205027 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464216948 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464225054 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.464238882 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464251041 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.464257956 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.464287043 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.648063898 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.648125887 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.648149014 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.648155928 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.648224115 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.650434017 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.650470972 CET	443	49713	104.102.49.254	192.168.2.7
Dec 18, 2024 15:08:00.650490999 CET	49713	443	192.168.2.7	104.102.49.254
Dec 18, 2024 15:08:00.650500059 CET	443	49713	104.102.49.254	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:07:55.695291042 CET	59373	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:55.982157946 CET	53	59373	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:55.986129999 CET	56157	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:56.203407049 CET	53	56157	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:56.207282066 CET	58173	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:56.428431988 CET	53	58173	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:56.430437088 CET	53191	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:56.645627022 CET	53	53191	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:56.648864985 CET	54338	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:56.870382071 CET	53	54338	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:56.877818108 CET	56562	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:57.108921051 CET	53	56562	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:57.110440969 CET	51130	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:57.400774956 CET	53	51130	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:57.649987936 CET	52122	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:57.870619059 CET	53	52122	1.1.1.1	192.168.2.7
Dec 18, 2024 15:07:57.970858097 CET	60522	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:07:58.108798027 CET	53	60522	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 15:07:55.695291042 CET	192.168.2.7	1.1.1.1	0x37a6	Standard query (0)	respectabosiz.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:55.986129999 CET	192.168.2.7	1.1.1.1	0x651a	Standard query (0)	worddosofrm.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.207282066 CET	192.168.2.7	1.1.1.1	0x923c	Standard query (0)	mutterissuen.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.430437088 CET	192.168.2.7	1.1.1.1	0xa895	Standard query (0)	standartedby.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.648864985 CET	192.168.2.7	1.1.1.1	0x6009	Standard query (0)	nightybinybz.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.877818108 CET	192.168.2.7	1.1.1.1	0x9716	Standard query (0)	conceszustyb.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:57.110440969 CET	192.168.2.7	1.1.1.1	0x913	Standard query (0)	bakedstusteeb.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:57.649987936 CET	192.168.2.7	1.1.1.1	0xe43a	Standard query (0)	moutheventushz.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:57.970858097 CET	192.168.2.7	1.1.1.1	0x55e5	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 15:07:55.982157946 CET	1.1.1.1	192.168.2.7	0x37a6	Name error (3)	respectabosiz.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.203407049 CET	1.1.1.1	192.168.2.7	0x651a	Name error (3)	worddosofrm.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.428431988 CET	1.1.1.1	192.168.2.7	0x923c	Name error (3)	mutterissuen.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.645627022 CET	1.1.1.1	192.168.2.7	0xa895	Name error (3)	standartedby.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:56.870382071 CET	1.1.1.1	192.168.2.7	0x6009	Name error (3)	nightybinybz.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:57.108921051 CET	1.1.1.1	192.168.2.7	0x9716	Name error (3)	conceszustyb.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:57.400774956 CET	1.1.1.1	192.168.2.7	0x913	Name error (3)	bakedstusteeb.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:57.870619059 CET	1.1.1.1	192.168.2.7	0xe43a	Name error (3)	moutheventushz.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:07:58.108798027 CET	1.1.1.1	192.168.2.7	0x55e5	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49713	104.102.49.254	443	7708	C:\Users\user\Desktop\f86nrrc6.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:07:59 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-18 14:08:00 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 18 Dec 2024 14:08:00 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=fb63f22e2ee3a484412bc217; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-18 14:08:00 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-18 14:08:00 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Target ID:	4
Start time:	09:07:43
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\f86nrrc6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f86nrrc6.exe"
Imagebase:	0x400000
File size:	7'238'808 bytes
MD5 hash:	F2A50F1B081EA3CD4821195676ADACF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	72.2%
Total number of Nodes:	169
Total number of Limit Nodes:	9

Executed Functions

Function 0040F560 Relevance: 7.9, Strings: 6, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k%h#, xrefs: 0040F742
-e0c, xrefs: 0040F7E2
}#{, xrefs: 0040F7A6
a-e+, xrefs: 0040F72E
9i7g, xrefs: 0040F7D8
c)t', xrefs: 0040F738

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: -e0c$9i7g$a-e+$c)t'$k%h#$}#{
API String ID: 0-851799077
Opcode ID: 84cfe9b165b5e4fde25793dd99f8b2c2bcb65518d7b2ab87b041a3917b3d91ee
Instruction ID: 226b39ae0588f89a9092dc77e17c664bc41f618938104ad4f5360f269260c37c
Opcode Fuzzy Hash: 84cfe9b165b5e4fde25793dd99f8b2c2bcb65518d7b2ab87b041a3917b3d91ee
Instruction Fuzzy Hash: 79F165B6600B01DFE3208F26D891797BBF5FF85314F148A2DD5EA8BA90DB74A4058F84

Function 0043B600 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043F3F2,005C003F,00000002,00000018,?), ref: 0043B62E

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction ID: 88b266f08c8d8dc656098dc4a5309144cffe720ba9f358246b073a6e310c2786
Opcode Fuzzy Hash: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction Fuzzy Hash: 47E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0040FF28 Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LO, xrefs: 0040FF9B

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: LO
API String ID: 0-4218834679
Opcode ID: 75a8acb2736b9bbca07126e771eacac5bc987dee8e051a9f25db1d155e375cd3
Instruction ID: 316a0c713d8ec889d0f2383d5a3762abcadb3709da7811cf17198a4df97889c8
Opcode Fuzzy Hash: 75a8acb2736b9bbca07126e771eacac5bc987dee8e051a9f25db1d155e375cd3
Instruction Fuzzy Hash: B3210572A483505FC324CF28CCC131BBAE1ABD6218F159A3DF5E5D77D5D67988008786

Non-executed Functions

Function 0041FDF0 Relevance: 30.6, Strings: 24, Instructions: 601
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!@, xrefs: 0041FE23
<, xrefs: 00420275
z, xrefs: 0041FE8C
x, xrefs: 0042060E
9, xrefs: 004200E8
{, xrefs: 0041FE94
{, xrefs: 00420606
{, xrefs: 00420367
l, xrefs: 004200F0
?, xrefs: 004200F8
=, xrefs: 00420108
Z, xrefs: 00420048
$, xrefs: 00420270
[, xrefs: 00420043
Y, xrefs: 0042004D
j, xrefs: 004200E0
z, xrefs: 0042035F
z, xrefs: 004205FE
%, xrefs: 0042027A
6, xrefs: 0042003E
x, xrefs: 0041FE9C
!, xrefs: 0042027F
<, xrefs: 00420100
x, xrefs: 0042036F

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID: !$!@$$$%$6$9$<$<$=$?$Y$Z$[$j$l$x$x$x$z$z$z${${${
API String ID: 2994545307-1571756884
Opcode ID: f1730ef8e42b2ada35d312604c8886e85bc1cc06c032119ea885c8af143ca059
Instruction ID: f91c82cc5f90e8b89dfc4b824f758c3499413eda674ffe0f2f419b91f75692ba
Opcode Fuzzy Hash: f1730ef8e42b2ada35d312604c8886e85bc1cc06c032119ea885c8af143ca059
Instruction Fuzzy Hash: 7B32E27160C3908FD324CB28D4543AFBBE1ABC5314F58896ED5DA87382D7BD88468B57

Function 004358F0 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 569
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.COMBASE(00442AB8,00000000,00000001,00442AA8,00000000), ref: 00435A29
SysAllocString.OLEAUT32(v'w!), ref: 00435AA5
CoSetProxyBlanket.COMBASE(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00435AEB
SysAllocString.OLEAUT32(69DD6BDD), ref: 00435B67
SysAllocString.OLEAUT32(89518B21), ref: 00435C13
VariantInit.OLEAUT32(?), ref: 00435C8C

Strings

C, xrefs: 004359DE
v'w!, xrefs: 00435A8C
c;m5, xrefs: 00435A52
\, xrefs: 004359E6
SQ, xrefs: 00435918
|{, xrefs: 00435BCF
03, xrefs: 00435A62

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: 03$C$\$c;m5$v'w!$|{$SQ
API String ID: 65563702-3459701557
Opcode ID: 5bf96e1d7beacc51bfd3f438cef484d64abb11964b03966416c9bd0aff63df05
Instruction ID: 8ee38e81a9ebfbdc9a92cdf509a7b5b91bc458359a7dce3f43b3968cf6a0eaab
Opcode Fuzzy Hash: 5bf96e1d7beacc51bfd3f438cef484d64abb11964b03966416c9bd0aff63df05
Instruction Fuzzy Hash: B4125371A087008FE724CF24C88676BBBE5EF89714F14892EF9959B390D778D905CB86

Function 00421A80 Relevance: 11.8, Strings: 9, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

uz, xrefs: 00421F8B
^gPa, xrefs: 00421F74
sXu, xrefs: 00421ED1
q"B, xrefs: 0042226B
{=, xrefs: 00421F93
tw, xrefs: 00421ED9
v~, xrefs: 00421FA3
] @, xrefs: 00421EED
wvy, xrefs: 00421D43

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: ] @$^gPa$q"B$tw$uz$v~${=$sXu$wvy
API String ID: 0-1187496957
Opcode ID: 79bf658a7d63fd16e88e9095b464f4e6e5c0b4600c436059d468af76157c99e3
Instruction ID: 11580da93081b44debf38894fec1cf3a1aeec49c2061deccd092facb7d853063
Opcode Fuzzy Hash: 79bf658a7d63fd16e88e9095b464f4e6e5c0b4600c436059d468af76157c99e3
Instruction Fuzzy Hash: DF02CBB45083509FE3109F25D84072BBBF0EF96758F04892DF9999B391E77889098B9B

Function 00423DD0 Relevance: 10.5, Strings: 8, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a%a', xrefs: 00423E4F
}z{x, xrefs: 00424146
}z{x, xrefs: 00424436
5M0O, xrefs: 00423E7F
(],_, xrefs: 00423E5F
7E9G, xrefs: 00423E8F
!Y)[, xrefs: 00423E57
9Q>S, xrefs: 00423E67

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: !Y)[$(],_$5M0O$7E9G$9Q>S$a%a'$}z{x$}z{x
API String ID: 0-3640916644
Opcode ID: 30bba2fa2acc5fceffbfaa08989d6f522ab6edea711b466a4607af9699cfd743
Instruction ID: 8038b8fc89dd961067976e9b5db2b0514576f957f4e335a3c0ff1a04589f3cd3
Opcode Fuzzy Hash: 30bba2fa2acc5fceffbfaa08989d6f522ab6edea711b466a4607af9699cfd743
Instruction Fuzzy Hash: 75F1E0B9608350DFE3148F25E88176BBBE2FBC6308F55992DE5C48B351D7789806CB46

Function 00424C70 Relevance: 9.3, Strings: 7, Instructions: 501COMMON

Download Yara Rule

Strings

ps, xrefs: 00425666
RZB, xrefs: 00425A43
}z{x, xrefs: 00425AF4
XZB, xrefs: 00425A52
F}w, xrefs: 004257A2
01, xrefs: 00425789
xZB, xrefs: 00425A72

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: 01$F}w$RZB$XZB$ps$xZB$}z{x
API String ID: 0-2234522390
Opcode ID: a5cb76377ed156033a2c522bb097e029bf772fc509a0d4ef35cfdb2f120a98f9
Instruction ID: 7c75d544a8c29c11e0f6f274e536c446b85ab27432b89beb213d306bd112cb90
Opcode Fuzzy Hash: a5cb76377ed156033a2c522bb097e029bf772fc509a0d4ef35cfdb2f120a98f9
Instruction Fuzzy Hash: EBF145B1A183508FD3208F65E88576BBBE1FBC6318F498A2DE4D49B351D7788805CB97

Function 0040DA20 Relevance: 6.7, Strings: 5, Instructions: 425COMMON

Download Yara Rule

Strings

N, xrefs: 0040DBE0
5731, xrefs: 0040DD95
zc, xrefs: 0040DBA1
<, xrefs: 0040DD6D
.%, xrefs: 0040DA84

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: .%$5731$<$N$zc
API String ID: 0-3590630948
Opcode ID: a339d7b774e9fb67e5e5ceacdd65e5825fb1bb6493b799b352ca91620ab2bc0e
Instruction ID: d361d60cf2ed4bacefb7b3db2f78a2fd6364d4ce0cb720ae1548083b2f500561
Opcode Fuzzy Hash: a339d7b774e9fb67e5e5ceacdd65e5825fb1bb6493b799b352ca91620ab2bc0e
Instruction Fuzzy Hash: C3B1E47050C3908FD325CF2984A076BBFE1AF97344F1848ADE5D55B392D77A880ACB96

Function 0040DE80 Relevance: 5.5, Strings: 4, Instructions: 466COMMON

Download Yara Rule

Strings

DX^3, xrefs: 0040E092, 0040E099, 0040E171, 0040E1D7
$, xrefs: 0040E0BE
, xrefs: 0040E185
PQ, xrefs: 0040E28E

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: $$$DX^3$PQ
API String ID: 0-2772110733
Opcode ID: 01d37171dfab4892303aaebfc74d19aa23d273df8484aae21f9065edfaa61c62
Instruction ID: 9a7bbf91fe650ef5fdbc314e9f1c13212ee9d96e8c444d51ecb61092464050ec
Opcode Fuzzy Hash: 01d37171dfab4892303aaebfc74d19aa23d273df8484aae21f9065edfaa61c62
Instruction Fuzzy Hash: E0E1F1716187808BD3248F35C89176BBBE1AFD6318F188A2DE5E1873A2D738D409CB46

Function 00408960 Relevance: 4.1, Strings: 3, Instructions: 391COMMON

Download Yara Rule

Strings

IEND, xrefs: 00408DC0
), xrefs: 004089DC
), xrefs: 004089E6

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: a5a3db8aab89d723de9191d6d5f3303008b0f0880391b782738ea7ae35a10764
Instruction ID: 3fe9b987952ccde178efa9f1f1c00db419640494b095269c1b53dd01ec44560a
Opcode Fuzzy Hash: a5a3db8aab89d723de9191d6d5f3303008b0f0880391b782738ea7ae35a10764
Instruction Fuzzy Hash: E9E1B071A087019FE310DF28C88571ABBE0BB94314F14463EE999A73D1DB79E915CBCA

Function 0040F0B0 Relevance: 4.1, Strings: 3, Instructions: 367COMMON

Download Yara Rule

Strings

(), xrefs: 0040F266
2, xrefs: 0040F4A5
0, xrefs: 0040F0CE

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: ()$0$2
API String ID: 0-2766669394
Opcode ID: 8693eff9a9b60096192bb9ab72382483b898d45a07cee045bb13913a89f04554
Instruction ID: 866e2b648f7bcc383e22ba6bbda90a5c047cd05d48a8e8d2e44f1a1a3b7545c2
Opcode Fuzzy Hash: 8693eff9a9b60096192bb9ab72382483b898d45a07cee045bb13913a89f04554
Instruction Fuzzy Hash: 1CC1D47050C3805BD324CF29D45036BBBE2ABD2358F18897DE4D59B792D779884ACB86

Function 00430A30 Relevance: 3.2, APIs: 2, Instructions: 155COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00430A72
GetSystemMetrics.USER32 ref: 00430A82

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 848ca4ac9c7c9123e47ac06bf2781841a63368e1a9ee2891494c07c3ac6088da
Instruction ID: fbbce7ad633b07f750d1d39319c3832ca9b6930809a03d8f12be590156538362
Opcode Fuzzy Hash: 848ca4ac9c7c9123e47ac06bf2781841a63368e1a9ee2891494c07c3ac6088da
Instruction Fuzzy Hash: 77A14CB040D3818BE370DF54C58879BBAE0BB85308F508D2EE5994B350DBB9594ACF97

Function 0043E5E0 Relevance: 3.1, Strings: 2, Instructions: 649COMMON

Download Yara Rule

Strings

2C, xrefs: 0043EE21
RC, xrefs: 0043EAD6

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: 2C$RC
API String ID: 0-1391150340
Opcode ID: fc5ff4035ef74794b7028ebda16b818d7be87af367fc3d0af348e6a1eedd5825
Instruction ID: 902639593efb1adc729ef976fb9a09d130562e765ab59f5f1a123f29baa4bf43
Opcode Fuzzy Hash: fc5ff4035ef74794b7028ebda16b818d7be87af367fc3d0af348e6a1eedd5825
Instruction Fuzzy Hash: 9922FF35B49251CFCB08CF68E8D06ABB7E2EF8A314F19997DD48587392D634AD41CB84

Function 004039B0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

Inf, xrefs: 00403A03
NaN, xrefs: 00403A0A

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: b2d6dbe4a8ed3ba7c3c3ece30ad588f21e603247d60f78f7ed55546bfa18716e
Instruction ID: 9d20fe0f1689027ec302827207c54d9aa33afb8cf0750e27db07b6bb90104c65
Opcode Fuzzy Hash: b2d6dbe4a8ed3ba7c3c3ece30ad588f21e603247d60f78f7ed55546bfa18716e
Instruction Fuzzy Hash: 73D1D272A083019BC704CF28C88161BBBE9EFC4751F258A3EF895A73D1E674DD458B86

Function 00413D2B Relevance: 2.1, Strings: 1, Instructions: 802COMMON

Download Yara Rule

Strings

s:q, xrefs: 0041457D

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: s:q
API String ID: 0-483140254
Opcode ID: 2fbcd08d13f8021f002303ea8d3e20b6aa275f7fa46ec9a352661307ee1a7e0d
Instruction ID: 6036188e1ed5018d006e1f384ad2fcb1d8c6c09e317ce672a3582a55f58dd5b1
Opcode Fuzzy Hash: 2fbcd08d13f8021f002303ea8d3e20b6aa275f7fa46ec9a352661307ee1a7e0d
Instruction Fuzzy Hash: FB522AB1A08B408FD7149F38D8853AABBE1AB95314F184A7ED4EBC77C2E639D445C706

Function 00405530 Relevance: 1.8, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00405902

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 38aad22bf880a385f5b3bc80ef90ccec1320577a8e042b7dd5b195cd37d88965
Instruction ID: 077f9847fbed58773027dffa039ca16d7d653e837e8eadc87091485fb59088b8
Opcode Fuzzy Hash: 38aad22bf880a385f5b3bc80ef90ccec1320577a8e042b7dd5b195cd37d88965
Instruction Fuzzy Hash: 9C12F4B6A08B418BE7258E559480327BBE2EFA0304F19857FD8956B3C1E779DC05CF4A

Function 004266F0 Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

ZpB, xrefs: 00426B7B

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: ZpB
API String ID: 0-696724286
Opcode ID: aac9f92ae41d74f6a34162c3a1563f505ed7264d0c5e5c8e9acf192fc5f7c0d0
Instruction ID: 0ccc64e59b4d2728c8f97c992ab3215f7c9b2ea39977d498fa6241edf0da81b1
Opcode Fuzzy Hash: aac9f92ae41d74f6a34162c3a1563f505ed7264d0c5e5c8e9acf192fc5f7c0d0
Instruction Fuzzy Hash: 5FC1FE752083518FD324CF24D8407ABBBF1FFC6704F01892DE999AB281D7B89909CB96

Function 0040AB40 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 0040AC76

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 3e27b3bc0118daddfb78c1ff50b696ff5a70bdc5a793623f9e2326fd38dc7343
Instruction ID: 226781dae8db81a62a14f97f140b8ef02ee1da9dd1e777bf2bcccb83acfa2f58
Opcode Fuzzy Hash: 3e27b3bc0118daddfb78c1ff50b696ff5a70bdc5a793623f9e2326fd38dc7343
Instruction Fuzzy Hash: 29B137711093819FD325CF28C88061BFBE1AFA9704F444E2EE5D997782D635E918CBA7

Function 0041D220 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 0041D331

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-2272463933
Opcode ID: 56ac3e6c7b0808a1757b2f3ff339e943d80b81c34b0f003aab39c65060a22481
Instruction ID: 8bb0e18666fd5cb64b807bf3461d7b0b5ca36abc21e6d5087c13faf7ad724bd6
Opcode Fuzzy Hash: 56ac3e6c7b0808a1757b2f3ff339e943d80b81c34b0f003aab39c65060a22481
Instruction Fuzzy Hash: 8D61F477E1AA904BC7148A7C4C412E9AA531BD733473E8377D8B18B3E5C57E88478356

Function 00411DB0 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

-4, xrefs: 00411FAE

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: -4
API String ID: 0-3249790742
Opcode ID: f245920793f3f06b5061773f2af4dc8e13cb0e84e1ed52610213c48ee7e60263
Instruction ID: 8aca84e40545209fdb2d8b35976cefb1c594da7aa5ff0c97ffd916c953638cdc
Opcode Fuzzy Hash: f245920793f3f06b5061773f2af4dc8e13cb0e84e1ed52610213c48ee7e60263
Instruction Fuzzy Hash: C6415B3662931057C32C8F68C89256BB792EF95308F19923FDD4A172A1DB799C418BCD

Function 0043F880 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

@, xrefs: 0043F8E9

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b77eeb9d4f4cfa6132d16a6903bb96af77942d9becee4474505664cb9fcd5ef3
Instruction ID: 6da14dff6695a29b7a138f1b5872fd1f2216a7a8924e699d2d19755c0f6557e7
Opcode Fuzzy Hash: b77eeb9d4f4cfa6132d16a6903bb96af77942d9becee4474505664cb9fcd5ef3
Instruction Fuzzy Hash: 7931F0755183049BC714DF18C88176BFBF5EF89314F05A82EE9A547290E73899088BAA

Function 00436350 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

}z{x, xrefs: 00436405

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: }z{x
API String ID: 0-1935807464
Opcode ID: b1715a965de853f533f5c5515e34f363177f258666483e832bf9f3e304972c17
Instruction ID: c2fe4bd197b3f8940e13c4d42f8ccc48d4f2f790a7f62d3db4fbfa854d76f439
Opcode Fuzzy Hash: b1715a965de853f533f5c5515e34f363177f258666483e832bf9f3e304972c17
Instruction Fuzzy Hash: 2C318D70A043017BE6109B15CC81B3B77A9DF9970CF01A53EFD9597252E239DC05C26E

Function 0041102F Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

-4, xrefs: 00411FAE

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID: -4
API String ID: 0-3249790742
Opcode ID: c1f68f55d8e8b98da7a8dc8f71a31de373854987414512868f1acd656190aac3
Instruction ID: ee78c7d0252da59181078afd55f973ef8b1dab3207e3fec2bebd3f090d2a1d50
Opcode Fuzzy Hash: c1f68f55d8e8b98da7a8dc8f71a31de373854987414512868f1acd656190aac3
Instruction Fuzzy Hash: 44C01238A180008B86088F20AC80139B27AAB8F20AB50A42AC01B6B222C274D442860C

Function 0040C170 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ba352af5ca715abe479738bb6b312ed046c57a3e05c3cd0d3c59ffe06acf4e
Instruction ID: f06f65b5d03a22e7db1d70af003363d6843660b59ca7c9bf4459dd449c9d9dac
Opcode Fuzzy Hash: f5ba352af5ca715abe479738bb6b312ed046c57a3e05c3cd0d3c59ffe06acf4e
Instruction Fuzzy Hash: 9A52B131618311CBC725DF18E9C026BB3E1FFC4315F258A3ED996A7285D738A951CB8A

Function 00412322 Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b58a2cc0768c28ccebc16d9dbc2abb942bb3a87778aafb11efddf1ece505375
Instruction ID: 60f0404e1f23d10ae4745407cc0b3a08e0d239165d91bd150a0d1b969d7f1e97
Opcode Fuzzy Hash: 9b58a2cc0768c28ccebc16d9dbc2abb942bb3a87778aafb11efddf1ece505375
Instruction Fuzzy Hash: AF5218B1508B408BD3249F38D5893EBBBD1AB95314F188D3ED8EBC33C2E679A4458716

Function 0040A5F0 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7ddd9723cf316ec1709d26cbdaaae7fb7236442668c9629ac40c32e8f4a8d3
Instruction ID: 618b86bf15bcba3e6bb4b432628653469f60eedb0241b407a2bfa20550f3c4a2
Opcode Fuzzy Hash: 2a7ddd9723cf316ec1709d26cbdaaae7fb7236442668c9629ac40c32e8f4a8d3
Instruction Fuzzy Hash: DDF1CF752083418FD724CF29C88176BBBE2AFD9304F08892EE5C587391E639E849CB56

Function 0040805C Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f5aa3711bdf0b8c49ed85d9b93d4e585c5b9c18ea3bafb98d431d863c3a0c4
Instruction ID: bd1723c223f7eb562c1353133bc042011f6623e0ddad751b3138fee0dd62ddd0
Opcode Fuzzy Hash: d3f5aa3711bdf0b8c49ed85d9b93d4e585c5b9c18ea3bafb98d431d863c3a0c4
Instruction Fuzzy Hash: 4802F370515B108FC328CF29C69052ABBF2BF857107644A2ED6D79BF91DB3AB845CB18

Function 00409340 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29218efef96e067422ec2fd3e5dc9a8299b5a00c7e48d3a2f96ac08650209e17
Instruction ID: 97253064c69b8c4f1bdb94304eb5ebecd96102c49767e0552a78d5c7ce022684
Opcode Fuzzy Hash: 29218efef96e067422ec2fd3e5dc9a8299b5a00c7e48d3a2f96ac08650209e17
Instruction Fuzzy Hash: D8F18879608201DFD708CF24E8A176AB7E2FBCA305F04893DE88587391D779E995CB85

Function 004247C0 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3d8fabf0e194c95c7a0dafbd075ce3d8357dc4ec84aad7939ffeedf01544423a
Instruction ID: 050cd24433f61f3763ad39defb1fc8a13c057351b8bc1ee48cf204f6d01fffd2
Opcode Fuzzy Hash: 3d8fabf0e194c95c7a0dafbd075ce3d8357dc4ec84aad7939ffeedf01544423a
Instruction Fuzzy Hash: 77C15B727083204BD714CF28E8923ABBBD2EBD1304F59853EE8968B381D63DDD058799

Function 00414763 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f3f698e9e391ba0a831ba0391560dfd341afd4c00482c3fcd74ebe4db06af0
Instruction ID: 7a2dfd4c9c44b8f34a642c7a5e7a99616abca5c8548b45e486e875ab3add2058
Opcode Fuzzy Hash: d3f3f698e9e391ba0a831ba0391560dfd341afd4c00482c3fcd74ebe4db06af0
Instruction Fuzzy Hash: 73E108B1A047408FC714EF38D4953AABBE1AF96314F194A3ED4DB87382E639E845C746

Function 00434FA0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcf0de0369a1c97715e9dc55c385f0aa391e82ddc83cc17cfee759ef651b1aa
Instruction ID: 35b3afdd10b6255075e5ec88915a7cba6496d670eb1086b6bfd8ab7444e40858
Opcode Fuzzy Hash: bfcf0de0369a1c97715e9dc55c385f0aa391e82ddc83cc17cfee759ef651b1aa
Instruction Fuzzy Hash: A3D11D73E04B918FC711C9BCCC8139ABFA15B5B324F1D8296D895DB392D17E98068792

Function 0040B1D0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d225d147fb8f80e038301bac62adfa292365b8edca26cfec2f3e898f4c5d4bc4
Instruction ID: 17896dd4266b7b630411069470114ff247ae57434cb980056c855e552f0d8074
Opcode Fuzzy Hash: d225d147fb8f80e038301bac62adfa292365b8edca26cfec2f3e898f4c5d4bc4
Instruction Fuzzy Hash: 2FC16BB29087418FC360CF28DC86BABB7E1EF85318F08492DD1D9D6342E778A155CB4A

Function 00440330 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7a2566a8df02482e6f8ea514137cd4a7534e3ff17f4b5a51d2ab025bb59693
Instruction ID: 58a69b57af7e24ee3c62efa82a7d8eee2b8501685cdd5d883de90afc41c95a7c
Opcode Fuzzy Hash: 2c7a2566a8df02482e6f8ea514137cd4a7534e3ff17f4b5a51d2ab025bb59693
Instruction Fuzzy Hash: 728126326083109BE728CF14C85176BB7E2EFC5314F19852EEA9647391DB79DC158B8A

Function 0043FCC0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4d67133e1f76e347ed4bd23e5fa145e2577103d4840d7d2c6d0733522e4c4a5
Instruction ID: d5e2c306aed0e9f0a4523fdea87c2092727505e879cf5e08cc8bb1e74fe301f1
Opcode Fuzzy Hash: d4d67133e1f76e347ed4bd23e5fa145e2577103d4840d7d2c6d0733522e4c4a5
Instruction Fuzzy Hash: 5E91D235A143018BD714DF18C850A2BB7E2FF99750F19A47EE9858B361EB34EC15CB8A

Function 0043F9D0 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 47efa7894c52dbbfda15281d9f5f0fdb6929cc71dc4ceafa39e0ce71118ea88c
Instruction ID: 448ffca5d87b80d32822c8b64973462d570a6b027f83770f115344b2745d6aa8
Opcode Fuzzy Hash: 47efa7894c52dbbfda15281d9f5f0fdb6929cc71dc4ceafa39e0ce71118ea88c
Instruction Fuzzy Hash: A6813976A183055BD714AF18C85073BB3E2FFC9350F09A43EE8858B351EB38E915979A

Function 00411FD0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334315078cbaae174f8a570c54b784edddb5051631464bdcb62a607130f57c0c
Instruction ID: 05021d5b9bbbf7fb7e0a61cc7d1feb84aaf99e560592e6d9dd0c3ffc95d10e9d
Opcode Fuzzy Hash: 334315078cbaae174f8a570c54b784edddb5051631464bdcb62a607130f57c0c
Instruction Fuzzy Hash: E6A14BB1904B409FC321DF39D94A3EBBFE9AB56310F14893EE4EAC3341D27561168B96

Function 00428B00 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e01eaddd3b08cbcbafba57961538796ca2ecad021c3de853168ded57cf657d
Instruction ID: 6b217d0bde1c941cb29440435e39900910855c354c974b111997b1ea3d25e248
Opcode Fuzzy Hash: 74e01eaddd3b08cbcbafba57961538796ca2ecad021c3de853168ded57cf657d
Instruction Fuzzy Hash: 6B61E57171A3219BD714CE29E58031FBBE2ABD5350F94C82EF4888B391DB78EC45874A

Function 00438330 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c6ca3d2bb1bb8eca0541fe856455ad95d0fabbc903a171a047880f17ab045889
Instruction ID: 767567ce47251ea28a1813ea366a1b038ceed0e869b8d918d7d8446cf86f5ca2
Opcode Fuzzy Hash: c6ca3d2bb1bb8eca0541fe856455ad95d0fabbc903a171a047880f17ab045889
Instruction Fuzzy Hash: 2D517C766083015BD7148B28C85473BF7A1EBDA754F29A47EF4C66B382EA34DC01879A

Function 00434D40 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f444a92e1affdee57848f95df307277b39aa4dc8594c659b45d49461fd2a1137
Instruction ID: ae04bbdf5937360d16f32479811ab3580af4a1633b7bc5b7c711c2fad65d9037
Opcode Fuzzy Hash: f444a92e1affdee57848f95df307277b39aa4dc8594c659b45d49461fd2a1137
Instruction Fuzzy Hash: 1F517DB16087548FE314DF29D49475BBBE1BBC8318F044A2EE5E987350E379DA088F86

Function 00436490 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebefbd2e81118e26db2bca344f504115a37fce991c450cc7815094b32cf2281a
Instruction ID: 19debb8a8d8565b76ee40dc244b2f2426bd5e4b62acc433009fbdb8ad7d8ecfd
Opcode Fuzzy Hash: ebefbd2e81118e26db2bca344f504115a37fce991c450cc7815094b32cf2281a
Instruction Fuzzy Hash: 4251907190C7556FCB258A2884903BFBBD29F99314F0A892EE4D64B386D23CDD05C785

Function 00405DE0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58504cef81af462c00d75cd3a6e1fd44affcc4a7f9be854e0ed3a881bcecbba
Instruction ID: 0d33a859858de1e777918ecbbea9d87bf78b6d517e5369397cfe6a83e4d9b11e
Opcode Fuzzy Hash: a58504cef81af462c00d75cd3a6e1fd44affcc4a7f9be854e0ed3a881bcecbba
Instruction Fuzzy Hash: 1051AE75A046019FC714DF18C480927B7A1FF89324F15467EF899AB392DA39EC42CF9A

Function 00409C61 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7139a7d65c172c95509649001ba5777967c86884962399ace91f58bab8b44ba7
Instruction ID: df614b7df28d3c373759bf57b018910391c4afda2941612bc8bfffe953c98c61
Opcode Fuzzy Hash: 7139a7d65c172c95509649001ba5777967c86884962399ace91f58bab8b44ba7
Instruction Fuzzy Hash: D651153610D380EFC7518F688880A5FBBE2BFDA300F48896DF584572A2D275D925DB57

Function 0040A070 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45645fe5c41b63afe76149a1f1d106a7e8655c1f0b71fd5b5b8261797b710ec6
Instruction ID: 95f36f4564cb873c363d7cd6bc568f58acadc4cf7d4da6ae083c5bfa51f704ac
Opcode Fuzzy Hash: 45645fe5c41b63afe76149a1f1d106a7e8655c1f0b71fd5b5b8261797b710ec6
Instruction Fuzzy Hash: 27516B3510D380EFC7518F689880A5FBBE2BFEA300F88496CF58417292D275C925DB57

Function 0041DAD0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a8ae54194628ce951a9ac1be7a92b04f1d02fe815cba58de101e68f4f2ef53
Instruction ID: 6a3c87ed268c674eb99f3637c0156bf68a3d7e0a263c8b87bddcd13a1fbb2be6
Opcode Fuzzy Hash: 25a8ae54194628ce951a9ac1be7a92b04f1d02fe815cba58de101e68f4f2ef53
Instruction Fuzzy Hash: EB312A75A08604EFD704DF28DC45BAB77E8EB8A354F14493DF849C7281E238D94587AA

Function 00438580 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1718495f1a67f714267e6f5497ce989f1457aed858257dd26a4debfbca120e
Instruction ID: 800bc67bdf34f8eb84e2d2acdca91b3e4e4a41be4a419d3d02d7bdb166052edc
Opcode Fuzzy Hash: 9d1718495f1a67f714267e6f5497ce989f1457aed858257dd26a4debfbca120e
Instruction Fuzzy Hash: AC3126765093108BD311CF19C88576BFBE0EBC9719F18A97DF4849B351CB7889068BDA

Function 00404D50 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a76eb7eb63eade94f7132feaaf8dedce8e54546576fc84971e28d0a71774e88
Instruction ID: 4c073cf3540596e04badca7617fc7e9bc7deaedfcf28b63a0a35df37db274471
Opcode Fuzzy Hash: 6a76eb7eb63eade94f7132feaaf8dedce8e54546576fc84971e28d0a71774e88
Instruction Fuzzy Hash: 5731A7B1604200DBD7559F19C88096BB7E1EFC4318F18893EE999A73C1D339DC52CB8A

Function 0040A228 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e400cc1ff9afcf8d7bade2eb00a7de6f57495f19deded93e5cef6c9839eea4d
Instruction ID: c60a43bc608d5191a59b833cd01f495d5c8f59cdd8d7f0654980d04143b3cf06
Opcode Fuzzy Hash: 1e400cc1ff9afcf8d7bade2eb00a7de6f57495f19deded93e5cef6c9839eea4d
Instruction Fuzzy Hash: 27314D3510D381EFD395CF28D884A9F7FE1AFE6200F8599ADF8804B292C674C458CB62

Function 00428140 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9fc61df29c2f1d0496c7ab837a9927e84d0bf5a8dd5682502c5fcd3b1fcbf4
Instruction ID: 6336afc45053181afdc7446a70e9b56c12bbfa34acc44c348cd50f34c0f480c3
Opcode Fuzzy Hash: 7b9fc61df29c2f1d0496c7ab837a9927e84d0bf5a8dd5682502c5fcd3b1fcbf4
Instruction Fuzzy Hash: A40192B170231147E6209F52E8C573BB2A89F84708F08453EE8089B381EF79EC26C299

Function 00407210 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1445237825.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1445221429.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000454000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004A4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004AF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004C3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000004F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000516000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000543000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000545000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000547000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000549000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000054F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000551000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000553000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000555000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000557000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000559000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F4000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005F8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.00000000005FE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000600000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000602000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000604000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000606000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000608000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.000000000062D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1445237825.0000000000856000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446204684.00000000009E3000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446229961.0000000000A0B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446250702.0000000000A11000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000000D6C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446465256.0000000001118000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1446720034.0000000001119000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_f86nrrc6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03e5394408b1fdc976f891483c031e2c6c7e2b4ccc8eb1f281f531e604d31db
Instruction ID: b9eed158d1a4c5a8f95884017e16127f008288ee18346c9cf546a7ae42f2f0ed
Opcode Fuzzy Hash: a03e5394408b1fdc976f891483c031e2c6c7e2b4ccc8eb1f281f531e604d31db
Instruction Fuzzy Hash: 54F0F62AB5C31A0BE620DEF99CC0827F3D6D7CA254B19423DF941D3391D479F80282A6

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f86nrrc6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
f86nrrc6.exe

Function 0040F560 Relevance: 7.9, Strings: 6, Instructions: 407
COMMON

Function 0043B600 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0040FF28 Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Function 0041FDF0 Relevance: 30.6, Strings: 24, Instructions: 601
COMMON

Function 004358F0 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 569
memorycomCOMMON

Function 00421A80 Relevance: 11.8, Strings: 9, Instructions: 544
COMMON

Function 00423DD0 Relevance: 10.5, Strings: 8, Instructions: 483
COMMON