Edit tour

Windows Analysis Report
LopCYSStr3.exe

Overview

General Information

Sample name:	LopCYSStr3.exe renamed because original name is a hash value
Original sample name:	2fe4852f3f183f8c7c00ef70bf432147.exe
Analysis ID:	1579788
MD5:	2fe4852f3f183f8c7c00ef70bf432147
SHA1:	8053e9d18e6ad8ebaafe8a9dd60d449114220e67
SHA256:	2a930563d17d930c161b091a30a0776025d9671de9a39da2179089000a74256d
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LopCYSStr3.exe (PID: 4148 cmdline: "C:\Users\user\Desktop\LopCYSStr3.exe" MD5: 2FE4852F3F183F8C7C00EF70BF432147)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["discokeyus.lat", "energyaffai.lat", "necklacebudi.lat", "aspecteirs.lat", "rapeflowwj.lat", "sweepyribs.lat", "grannyejh.lat", "sustainskelet.lat", "crosshuaht.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:06.965220+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.102.49.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.837762+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.5	52048	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:05.119789+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.5	51672	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.407874+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.5	50882	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.697134+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.5	50649	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.265494+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.5	53061	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.555393+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.5	59622	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:05.260803+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.5	54496	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.978083+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.5	60519	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:04.119725+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.5	54436	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T09:09:07.691794+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LopCYSStr3.exe

Avira: detected

Found malware configuration

Source: LopCYSStr3.exe.4148.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["discokeyus.lat", "energyaffai.lat", "necklacebudi.lat", "aspecteirs.lat", "rapeflowwj.lat", "sweepyribs.lat", "grannyejh.lat", "sustainskelet.lat", "crosshuaht.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: LopCYSStr3.exe	ReversingLabs: Detection: 63%
Source: LopCYSStr3.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: LopCYSStr3.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2069176399.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: LopCYSStr3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	0_2_001BC767
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	0_2_0018B70C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov edx, ecx	0_2_00189C4A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, esi	0_2_001A2190
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_001A2190
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_001A2190
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	0_2_00196263
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then jmp dword ptr [001C450Ch]	0_2_00198591
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	0_2_001B85E0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then jmp eax	0_2_001B85E0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov eax, dword ptr [001C473Ch]	0_2_0019C653
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_001AA700
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	0_2_0019E7C0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov edx, ecx	0_2_001B8810
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	0_2_001B8810
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	0_2_001B8810
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then test eax, eax	0_2_001B8810
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0019682D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	0_2_0019682D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	0_2_0019682D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, edx	0_2_0018C8B6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4B6A4A26h]	0_2_0018C8B6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_001ACA49
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then push ebx	0_2_001BCA93
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_001ACAD0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_001ACB11
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_001ACB22
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0019CB40
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_0019CB40
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_001A8B61
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp al, 2Eh	0_2_001A6B95
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	0_2_001BECA0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	0_2_001A8D93
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ecx, eax	0_2_001BAEC0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	0_2_00188F50
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_00188F50
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	0_2_001BEFB0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then push C0BFD6CCh	0_2_001A3086
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then push C0BFD6CCh	0_2_001A3086
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_001AB170
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_001A91DD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	0_2_001A91DD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	0_2_001BB1D0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, eax	0_2_001BB1D0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	0_2_00195220
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0019B2E0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	0_2_001BF330
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	0_2_00197380
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	0_2_0019D380
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_001B5450
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	0_2_00197380
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_001A91DD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	0_2_001A91DD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_001874F0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_001874F0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then xor edi, edi	0_2_0019759F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ecx, eax	0_2_00189580
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	0_2_00189580
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov esi, eax	0_2_00195799
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ecx, eax	0_2_00195799
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx eax, word ptr [edx]	0_2_001997C2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [edi], dx	0_2_001997C2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_001997C2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov word ptr [ecx], bp	0_2_0019D83A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then jmp eax	0_2_001A984F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	0_2_001A3860
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, eax	0_2_00185990
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebp, eax	0_2_00185990
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	0_2_001979C1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_001ADA53
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then push esi	0_2_001A7AD3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, eax	0_2_0018DBD9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ebx, eax	0_2_0018DBD9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then push 00000000h	0_2_001A9C2B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	0_2_00197DEE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then jmp dword ptr [001C55F4h]	0_2_001A5E30
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov edx, ebp	0_2_001A5E70
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0019BF14
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	0_2_00199F30
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then jmp ecx	0_2_0018BFFD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 4x nop then mov ecx, ebx	0_2_001ADFE9

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.5:54496 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.5:50649 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.5:59622 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.5:54436 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.5:51672 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.5:60519 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.5:52048 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.5:50882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.5:53061 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49704 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.102.49.254:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=14725e4f9b355e3c28593a91; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 23 Dec 2024 08:09:07 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control, equals www.youtube.com (Youtube)
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C12000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900))
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C46000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C46000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: LopCYSStr3.exe	Static PE information: section name:
Source: LopCYSStr3.exe	Static PE information: section name: .rsrc
Source: LopCYSStr3.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00188850	0_2_00188850
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0018ACF0	0_2_0018ACF0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00278035	0_2_00278035
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0029E01A	0_2_0029E01A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00286011	0_2_00286011
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FC06E	0_2_002FC06E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E4078	0_2_002E4078
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00312069	0_2_00312069
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026C07C	0_2_0026C07C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027E04B	0_2_0027E04B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00296045	0_2_00296045
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00216056	0_2_00216056
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022005E	0_2_0022005E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EC09F	0_2_001EC09F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003140A2	0_2_003140A2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002080B4	0_2_002080B4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020C0B9	0_2_0020C0B9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002740FA	0_2_002740FA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020E0C7	0_2_0020E0C7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002480D2	0_2_002480D2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028E0D1	0_2_0028E0D1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CC0D7	0_2_002CC0D7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F4129	0_2_002F4129
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B	0_2_0034C12B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00298119	0_2_00298119
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025011E	0_2_0025011E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B8168	0_2_002B8168
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F6162	0_2_002F6162
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BA174	0_2_002BA174
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00212141	0_2_00212141
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E2141	0_2_002E2141
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AC15B	0_2_002AC15B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CA15D	0_2_002CA15D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F4166	0_2_001F4166
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EE155	0_2_002EE155
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AA1AB	0_2_002AA1AB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E01AC	0_2_002E01AC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A2190	0_2_001A2190
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028A1B2	0_2_0028A1B2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002561BA	0_2_002561BA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022618B	0_2_0022618B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025A197	0_2_0025A197
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003001F1	0_2_003001F1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F81DB	0_2_001F81DB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B61EF	0_2_002B61EF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002301E4	0_2_002301E4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A41C0	0_2_001A41C0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B21F0	0_2_002B21F0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002381C8	0_2_002381C8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002521D4	0_2_002521D4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FE1DC	0_2_002FE1DC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026C1DB	0_2_0026C1DB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002581DB	0_2_002581DB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00314233	0_2_00314233
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034423C	0_2_0034423C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027C22D	0_2_0027C22D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030C23C	0_2_0030C23C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00228230	0_2_00228230
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030A222	0_2_0030A222
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026A207	0_2_0026A207
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00260207	0_2_00260207
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D821E	0_2_002D821E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C8214	0_2_002C8214
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F025A	0_2_001F025A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00218275	0_2_00218275
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B027F	0_2_002B027F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030426B	0_2_0030426B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DA270	0_2_002DA270
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A0275	0_2_002A0275
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E8271	0_2_001E8271
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021024E	0_2_0021024E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00234255	0_2_00234255
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00196263	0_2_00196263
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E0265	0_2_001E0265
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00262259	0_2_00262259
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0019E290	0_2_0019E290
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00186280	0_2_00186280
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E2281	0_2_001E2281
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00282282	0_2_00282282
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F0285	0_2_002F0285
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024A28B	0_2_0024A28B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025C29C	0_2_0025C29C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003022EE	0_2_003022EE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DE2C6	0_2_002DE2C6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F2317	0_2_001F2317
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A6323	0_2_002A6323
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A830D	0_2_001A830D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001AA33F	0_2_001AA33F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00188330	0_2_00188330
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DC307	0_2_002DC307
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00184320	0_2_00184320
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D2377	0_2_002D2377
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021A340	0_2_0021A340
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00276352	0_2_00276352
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027C3A5	0_2_0027C3A5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030E3BA	0_2_0030E3BA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CE3BC	0_2_002CE3BC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A4380	0_2_001A4380
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FC38F	0_2_002FC38F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025438C	0_2_0025438C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028E398	0_2_0028E398
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024439E	0_2_0024439E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EE3A1	0_2_001EE3A1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003043F3	0_2_003043F3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002923F1	0_2_002923F1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001FC3C2	0_2_001FC3C2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001AC3FC	0_2_001AC3FC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021C429	0_2_0021C429
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022442D	0_2_0022442D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E4432	0_2_002E4432
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028C40A	0_2_0028C40A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00284401	0_2_00284401
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F4401	0_2_002F4401
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00258414	0_2_00258414
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BC41C	0_2_002BC41C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00240462	0_2_00240462
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0031247B	0_2_0031247B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AC467	0_2_002AC467
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028847F	0_2_0028847F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F8477	0_2_002F8477
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C044F	0_2_002C044F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026644A	0_2_0026644A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BE454	0_2_002BE454
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026E4AA	0_2_0026E4AA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020A4B8	0_2_0020A4B8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EE4E7	0_2_002EE4E7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EC4D4	0_2_001EC4D4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002504FF	0_2_002504FF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A2510	0_2_001A2510
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0029450F	0_2_0029450F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E0509	0_2_002E0509
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024C51B	0_2_0024C51B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E655D	0_2_001E655D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F855B	0_2_001F855B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001FC556	0_2_001FC556
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027E571	0_2_0027E571
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027A579	0_2_0027A579
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020C547	0_2_0020C547
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DE55F	0_2_002DE55F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00252551	0_2_00252551
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025E553	0_2_0025E553
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00236554	0_2_00236554
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B8552	0_2_002B8552
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0029C553	0_2_0029C553
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023E5A3	0_2_0023E5A3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A25B5	0_2_002A25B5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00298583	0_2_00298583
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0033659C	0_2_0033659C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EC5E2	0_2_002EC5E2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F25FF	0_2_002F25FF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002085F8	0_2_002085F8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003005E9	0_2_003005E9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C85F0	0_2_002C85F0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002385CF	0_2_002385CF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002825D8	0_2_002825D8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023C5DA	0_2_0023C5DA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00256621	0_2_00256621
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026A62D	0_2_0026A62D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E060C	0_2_001E060C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022863E	0_2_0022863E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A660F	0_2_002A660F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020260A	0_2_0020260A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B2606	0_2_002B2606
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A461F	0_2_002A461F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E2611	0_2_002E2611
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E4650	0_2_001E4650
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00262677	0_2_00262677
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C6678	0_2_002C6678
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B6672	0_2_002B6672
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030666B	0_2_0030666B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027467B	0_2_0027467B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D0643	0_2_002D0643
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D8642	0_2_002D8642
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024A658	0_2_0024A658
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B0657	0_2_002B0657
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A86A9	0_2_002A86A9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021E6AD	0_2_0021E6AD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AC6B9	0_2_002AC6B9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002186BB	0_2_002186BB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E868F	0_2_002E868F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00234681	0_2_00234681
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00308697	0_2_00308697
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A66D0	0_2_001A66D0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CC6FD	0_2_002CC6FD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FC6F7	0_2_002FC6F7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A86C0	0_2_001A86C0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030C6D2	0_2_0030C6D2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F46FA	0_2_001F46FA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003126C3	0_2_003126C3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D46D5	0_2_002D46D5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002446DB	0_2_002446DB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021A725	0_2_0021A725
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00186710	0_2_00186710
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023A73B	0_2_0023A73B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AE735	0_2_002AE735
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028070A	0_2_0028070A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034A713	0_2_0034A713
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00268710	0_2_00268710
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00242776	0_2_00242776
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024E776	0_2_0024E776
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022A77F	0_2_0022A77F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E6773	0_2_002E6773
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DE74D	0_2_002DE74D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EE75E	0_2_002EE75E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00198792	0_2_00198792
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002647A9	0_2_002647A9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CA7BC	0_2_002CA7BC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0018A780	0_2_0018A780
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026A7BD	0_2_0026A7BD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F8789	0_2_002F8789
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FE788	0_2_002FE788
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A079D	0_2_002A079D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022279F	0_2_0022279F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002787EC	0_2_002787EC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003127E5	0_2_003127E5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0019E7C0	0_2_0019E7C0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BC7F0	0_2_002BC7F0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028C7DA	0_2_0028C7DA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025C824	0_2_0025C824
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001B8810	0_2_001B8810
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AC80D	0_2_002AC80D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00310802	0_2_00310802
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0019682D	0_2_0019682D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021C816	0_2_0021C816
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00304809	0_2_00304809
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030E876	0_2_0030E876
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00226874	0_2_00226874
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E4878	0_2_002E4878
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F2878	0_2_002F2878
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00290842	0_2_00290842
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00250852	0_2_00250852
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D6857	0_2_002D6857
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D28AD	0_2_002D28AD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EA8AE	0_2_002EA8AE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C88B4	0_2_002C88B4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B28B0	0_2_002B28B0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00240885	0_2_00240885
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022C880	0_2_0022C880
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0018C8B6	0_2_0018C8B6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00220893	0_2_00220893
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026C897	0_2_0026C897
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002248E2	0_2_002248E2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022E8EC	0_2_0022E8EC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A88CB	0_2_001A88CB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AA8F9	0_2_002AA8F9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002948DE	0_2_002948DE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EE8E4	0_2_001EE8E4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DA93D	0_2_002DA93D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030A92A	0_2_0030A92A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CE930	0_2_002CE930
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0031292D	0_2_0031292D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A0939	0_2_001A0939
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00314901	0_2_00314901
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A491F	0_2_002A491F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F6914	0_2_002F6914
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FA912	0_2_002FA912
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024C91A	0_2_0024C91A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001B0940	0_2_001B0940
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030496B	0_2_0030496B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025894A	0_2_0025894A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EA965	0_2_001EA965
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002149AE	0_2_002149AE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020C9B2	0_2_0020C9B2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002369BC	0_2_002369BC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E49B7	0_2_001E49B7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026698C	0_2_0026698C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00248999	0_2_00248999
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002409E9	0_2_002409E9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003089EB	0_2_003089EB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D09CE	0_2_002D09CE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EC9FA	0_2_001EC9FA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0029A9C1	0_2_0029A9C1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003009DB	0_2_003009DB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023A9DA	0_2_0023A9DA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003349CC	0_2_003349CC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021EA21	0_2_0021EA21
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00244A25	0_2_00244A25
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030EA31	0_2_0030EA31
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0018EA10	0_2_0018EA10
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00202A2C	0_2_00202A2C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027EA3D	0_2_0027EA3D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028AA17	0_2_0028AA17
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BEA66	0_2_002BEA66
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001ACA49	0_2_001ACA49
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C2A79	0_2_002C2A79
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E0A7B	0_2_001E0A7B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00272A57	0_2_00272A57
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FCA5F	0_2_002FCA5F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00230A5C	0_2_00230A5C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030CAB3	0_2_0030CAB3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00260ABD	0_2_00260ABD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CCAB1	0_2_002CCAB1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C0A8A	0_2_002C0A8A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00274A8A	0_2_00274A8A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D8A9D	0_2_002D8A9D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B6A91	0_2_002B6A91
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020AA9C	0_2_0020AA9C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00208AE4	0_2_00208AE4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001ACAD0	0_2_001ACAD0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EEACB	0_2_002EEACB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F6AF0	0_2_001F6AF0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00218AD7	0_2_00218AD7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AEB29	0_2_002AEB29
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C6B28	0_2_002C6B28
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BAB2C	0_2_002BAB2C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001ACB11	0_2_001ACB11
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B8B27	0_2_002B8B27
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00256B37	0_2_00256B37
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001B6B08	0_2_001B6B08
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028CB34	0_2_0028CB34
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002ECB30	0_2_002ECB30
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A0B0D	0_2_002A0B0D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001ACB22	0_2_001ACB22
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021AB1C	0_2_0021AB1C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00268B18	0_2_00268B18
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00314B74	0_2_00314B74
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A6B50	0_2_001A6B50
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F4B4D	0_2_001F4B4D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F8B7D	0_2_002F8B7D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00246B72	0_2_00246B72
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D4B7B	0_2_002D4B7B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0019CB40	0_2_0019CB40
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00288B57	0_2_00288B57
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025EBAF	0_2_0025EBAF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025CBB2	0_2_0025CBB2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B0BBC	0_2_002B0BBC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FCBB0	0_2_002FCBB0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C4B8C	0_2_002C4B8C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028AB89	0_2_0028AB89
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DEB9F	0_2_002DEB9F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E8BA2	0_2_001E8BA2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030CBF7	0_2_0030CBF7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00200BED	0_2_00200BED
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00348BE2	0_2_00348BE2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CABF4	0_2_002CABF4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00252BC7	0_2_00252BC7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00258BCA	0_2_00258BCA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00272BDA	0_2_00272BDA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024EBDA	0_2_0024EBDA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B2C2D	0_2_002B2C2D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F4C3C	0_2_002F4C3C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CCC35	0_2_002CCC35
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EEC04	0_2_001EEC04
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00276C3D	0_2_00276C3D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026CC12	0_2_0026CC12
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00254C1E	0_2_00254C1E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A2C62	0_2_002A2C62
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00244C68	0_2_00244C68
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E4C74	0_2_002E4C74
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00278C45	0_2_00278C45
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00184C60	0_2_00184C60
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E6C65	0_2_001E6C65
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00286C53	0_2_00286C53
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BCCAA	0_2_002BCCAA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DACAE	0_2_002DACAE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00202CA6	0_2_00202CA6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001AAC90	0_2_001AAC90
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0029EC9D	0_2_0029EC9D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001BECA0	0_2_001BECA0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022ECE3	0_2_0022ECE3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00234CE5	0_2_00234CE5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00302CE0	0_2_00302CE0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023ECF1	0_2_0023ECF1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E8CF2	0_2_002E8CF2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026ACD0	0_2_0026ACD0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E0CD6	0_2_002E0CD6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EACD4	0_2_002EACD4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EED1B	0_2_001EED1B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002ACD25	0_2_002ACD25
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C8D3C	0_2_002C8D3C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F0D0C	0_2_001F0D0C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00220D37	0_2_00220D37
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00260D3E	0_2_00260D3E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00284D34	0_2_00284D34
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00206D63	0_2_00206D63
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00282D66	0_2_00282D66
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EAD4D	0_2_001EAD4D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0018CD46	0_2_0018CD46
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F8D6E	0_2_001F8D6E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00290D5D	0_2_00290D5D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023CDA8	0_2_0023CDA8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DCDB8	0_2_002DCDB8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00296DBF	0_2_00296DBF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0029CDB0	0_2_0029CDB0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00226DB9	0_2_00226DB9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00214DBD	0_2_00214DBD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BED89	0_2_002BED89
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B4D91	0_2_002B4D91
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023ADF6	0_2_0023ADF6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00306DC3	0_2_00306DC3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00308DCD	0_2_00308DCD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00222E21	0_2_00222E21
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00312E32	0_2_00312E32
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001FAE19	0_2_001FAE19
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00298E24	0_2_00298E24
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001ECE0D	0_2_001ECE0D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C4E03	0_2_002C4E03
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CCE1E	0_2_002CCE1E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E4E60	0_2_002E4E60
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002EAE7D	0_2_002EAE7D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001B6E74	0_2_001B6E74
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021EE50	0_2_0021EE50
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A6E5F	0_2_002A6E5F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C0EAC	0_2_002C0EAC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00216EA0	0_2_00216EA0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A2EA3	0_2_002A2EA3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00210EB0	0_2_00210EB0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00268EBA	0_2_00268EBA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D2E87	0_2_002D2E87
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002ACE84	0_2_002ACE84
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00218EE1	0_2_00218EE1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001BAEC0	0_2_001BAEC0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00238EFC	0_2_00238EFC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00254EC0	0_2_00254EC0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C6EC6	0_2_002C6EC6
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028AEDF	0_2_0028AEDF
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E4EE2	0_2_001E4EE2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E2EE0	0_2_001E2EE0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E8F2E	0_2_002E8F2E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D4F2F	0_2_002D4F2F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021CF29	0_2_0021CF29
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002C2F20	0_2_002C2F20
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B2F3B	0_2_002B2F3B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B0F36	0_2_002B0F36
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00242F14	0_2_00242F14
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00306F71	0_2_00306F71
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001B8F59	0_2_001B8F59
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00182F50	0_2_00182F50
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A0F50	0_2_001A0F50
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025CF74	0_2_0025CF74
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F4F73	0_2_002F4F73
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002D8F4F	0_2_002D8F4F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BAF4E	0_2_002BAF4E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00300F55	0_2_00300F55
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001ACF74	0_2_001ACF74
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00212F4F	0_2_00212F4F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00246FA5	0_2_00246FA5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A0FAD	0_2_002A0FAD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BEFB9	0_2_002BEFB9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FCFBB	0_2_002FCFBB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022EFB4	0_2_0022EFB4
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EAF82	0_2_001EAF82
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F4F83	0_2_001F4F83
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00272FBB	0_2_00272FBB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00280FB5	0_2_00280FB5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0026EF82	0_2_0026EF82
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001FAFB5	0_2_001FAFB5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001BEFB0	0_2_001BEFB0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E0FB0	0_2_001E0FB0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00230F90	0_2_00230F90
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F2FA1	0_2_001F2FA1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002FAFE3	0_2_002FAFE3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020AFF2	0_2_0020AFF2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0028CFFB	0_2_0028CFFB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00252FF2	0_2_00252FF2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00314FD7	0_2_00314FD7
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002AAFC1	0_2_002AAFC1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0021AFD2	0_2_0021AFD2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002CCFD5	0_2_002CCFD5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E6FD5	0_2_002E6FD5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F6FE1	0_2_001F6FE1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E9020	0_2_002E9020
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020F03B	0_2_0020F03B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00263000	0_2_00263000
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025100C	0_2_0025100C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00287015	0_2_00287015
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0030B07D	0_2_0030B07D
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0023F073	0_2_0023F073
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002BD070	0_2_002BD070
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022D07E	0_2_0022D07E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0025507A	0_2_0025507A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001EF07C	0_2_001EF07C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020D04B	0_2_0020D04B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00259056	0_2_00259056
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003030B3	0_2_003030B3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024F0AA	0_2_0024F0AA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003090A5	0_2_003090A5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002F909E	0_2_002F909E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00283093	0_2_00283093
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001E70A3	0_2_001E70A3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_003410D8	0_2_003410D8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0027F0D0	0_2_0027F0D0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024D13E	0_2_0024D13E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0024B139	0_2_0024B139
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00209101	0_2_00209101
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0020311C	0_2_0020311C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A7148	0_2_002A7148
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00311142	0_2_00311142
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DB158	0_2_002DB158
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001F1162	0_2_001F1162
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0022B1B2	0_2_0022B1B2
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002B71BB	0_2_002B71BB
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001891B0	0_2_001891B0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00293183	0_2_00293183
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002E1184	0_2_002E1184
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002A3181	0_2_002A3181
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001A91DD	0_2_001A91DD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002DF1EA	0_2_002DF1EA
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_002271E8	0_2_002271E8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001BB1D0	0_2_001BB1D0

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: String function: 00188030 appears 46 times
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: String function: 00194400 appears 65 times

Source: LopCYSStr3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LopCYSStr3.exe

Static PE information: Section: ZLIB complexity 0.9973044199486302

Source: LopCYSStr3.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/1

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Code function: 0_2_001B0C70 CoCreateInstance,

0_2_001B0C70

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LopCYSStr3.exe	ReversingLabs: Detection: 63%
Source: LopCYSStr3.exe	Virustotal: Detection: 67%

Source: LopCYSStr3.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\LopCYSStr3.exe

File read: C:\Users\user\Desktop\LopCYSStr3.exe

Jump to behavior

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Section loaded: dpapi.dll	Jump to behavior

Source: LopCYSStr3.exe

Static file information: File size 2906624 > 1048576

Source: LopCYSStr3.exe

Static PE information: Raw size of awmwdrqo is bigger than: 0x100000 < 0x29da00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Unpacked PE file: 0.2.LopCYSStr3.exe.180000.0.unpack :EW;.rsrc :W;.idata :W;awmwdrqo:EW;uovzuipz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;awmwdrqo:EW;uovzuipz:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: LopCYSStr3.exe

Static PE information: real checksum: 0x2ce3af should be: 0x2c9507

Source: LopCYSStr3.exe	Static PE information: section name:
Source: LopCYSStr3.exe	Static PE information: section name: .rsrc
Source: LopCYSStr3.exe	Static PE information: section name: .idata
Source: LopCYSStr3.exe	Static PE information: section name: awmwdrqo
Source: LopCYSStr3.exe	Static PE information: section name: uovzuipz
Source: LopCYSStr3.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00460027 push 0EBE596Eh; mov dword ptr [esp], eax	0_2_00460065
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00460027 push eax; mov dword ptr [esp], esp	0_2_004600F0
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_00460027 push ecx; mov dword ptr [esp], 68F8A2D2h	0_2_0046015B
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001DC06C push ecx; mov dword ptr [esp], edi	0_2_001DE569
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001DC09D push 1B3AAA17h; mov dword ptr [esp], edx	0_2_001DC0A8
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001DC09D push ebp; mov dword ptr [esp], edx	0_2_001DCB55
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_001DC0B6 push 21E6ECD1h; mov dword ptr [esp], edi	0_2_001DC0D3
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 34B1744Dh; mov dword ptr [esp], esp	0_2_0034C13A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push edi; mov dword ptr [esp], eax	0_2_0034C17C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 087E9D90h; mov dword ptr [esp], ecx	0_2_0034C23F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push ebp; mov dword ptr [esp], edi	0_2_0034C243
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push ecx; mov dword ptr [esp], 39B876AAh	0_2_0034C2BD
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push ecx; mov dword ptr [esp], 6FEDF2D6h	0_2_0034C2DE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push edi; mov dword ptr [esp], edx	0_2_0034C32F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push ebx; mov dword ptr [esp], edx	0_2_0034C335
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 624D4CA7h; mov dword ptr [esp], edx	0_2_0034C4C5
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push esi; mov dword ptr [esp], eax	0_2_0034C501
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push edi; mov dword ptr [esp], edx	0_2_0034C530
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push eax; mov dword ptr [esp], esi	0_2_0034C570
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 114170B6h; mov dword ptr [esp], ebx	0_2_0034C5C9
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 723FA28Eh; mov dword ptr [esp], edi	0_2_0034C5D1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push ebx; mov dword ptr [esp], eax	0_2_0034C627
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 29118CF5h; mov dword ptr [esp], edx	0_2_0034C69E
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 5411C973h; mov dword ptr [esp], edi	0_2_0034C6AC
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push ebp; mov dword ptr [esp], ebx	0_2_0034C72C
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 58576D1Ch; mov dword ptr [esp], eax	0_2_0034C7A1
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push eax; mov dword ptr [esp], ecx	0_2_0034C897
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 0414CC00h; mov dword ptr [esp], ebp	0_2_0034C8EE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push 28327F38h; mov dword ptr [esp], esi	0_2_0034C96F
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push edi; mov dword ptr [esp], eax	0_2_0034CA5A
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Code function: 0_2_0034C12B push edi; mov dword ptr [esp], 52AB7612h	0_2_0034CB08

Source: LopCYSStr3.exe

Static PE information: section name: entropy: 7.9752924462904415

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\LopCYSStr3.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 1D82E1 second address: 1D82E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 1D82E7 second address: 1D82EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 351B11 second address: 351B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 351B17 second address: 351B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 351B1C second address: 351B59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F13590914CDh 0x00000008 jmp 00007F13590914D1h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F13590914D9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 350B52 second address: 350B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1359094356h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 350F8D second address: 350F9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F13590914C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3512B5 second address: 3512BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3512BD second address: 3512C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 35141F second address: 351447 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094361h 0x00000007 jmp 00007F1359094360h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 35408C second address: 354097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F13590914C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3542C7 second address: 3542CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3542CB second address: 354322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F13590914D8h 0x0000000c pop edx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 mov dword ptr [ebp+122D1C8Eh], eax 0x00000017 push 00000000h 0x00000019 jmp 00007F13590914CDh 0x0000001e pushad 0x0000001f mov cx, B250h 0x00000023 mov bl, B2h 0x00000025 popad 0x00000026 push C41614B7h 0x0000002b pushad 0x0000002c pushad 0x0000002d jmp 00007F13590914CDh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 354322 second address: 35432F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F135909435Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 35432F second address: 3543FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 3BE9EBC9h 0x0000000c call 00007F13590914CFh 0x00000011 call 00007F13590914D4h 0x00000016 mov di, 7605h 0x0000001a pop edx 0x0000001b pop esi 0x0000001c push 00000003h 0x0000001e or edi, dword ptr [ebp+122D2E07h] 0x00000024 push ebx 0x00000025 jnc 00007F13590914D0h 0x0000002b pop esi 0x0000002c push 00000000h 0x0000002e mov esi, dword ptr [ebp+122D2F3Eh] 0x00000034 mov ecx, ebx 0x00000036 push 00000003h 0x00000038 jnc 00007F13590914C8h 0x0000003e push 90850B4Ah 0x00000043 jmp 00007F13590914D9h 0x00000048 add dword ptr [esp], 2F7AF4B6h 0x0000004f jmp 00007F13590914D9h 0x00000054 lea ebx, dword ptr [ebp+1244FFF7h] 0x0000005a mov esi, dword ptr [ebp+122D205Bh] 0x00000060 xchg eax, ebx 0x00000061 jne 00007F13590914D9h 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push edi 0x0000006d pop edi 0x0000006e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3543FD second address: 354410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F135909435Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 354410 second address: 354416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 365133 second address: 365147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jne 00007F1359094356h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 374458 second address: 37445F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 37445F second address: 374465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 37231C second address: 372387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F13590914D1h 0x00000008 jmp 00007F13590914D1h 0x0000000d popad 0x0000000e ja 00007F13590914D2h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edi 0x00000017 jmp 00007F13590914D9h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F13590914D5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 372387 second address: 37238B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 37238B second address: 372391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 372630 second address: 372634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 372A0C second address: 372A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 372A10 second address: 372A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 372CCA second address: 372CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F13590914C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 372CD6 second address: 372D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F1359094363h 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1359094365h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373185 second address: 373195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F13590914C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373195 second address: 373199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373199 second address: 37319F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 37319F second address: 3731A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3732F6 second address: 3732FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3732FA second address: 373303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373482 second address: 373488 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373488 second address: 3734B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F1359094356h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1359094367h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3734B5 second address: 3734D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F13590914D3h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3734D1 second address: 3734DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3734DA second address: 3734F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F13590914D2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 36AD7C second address: 36ADA0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1359094356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1359094367h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 36ADA0 second address: 36ADC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jng 00007F13590914D7h 0x00000017 jmp 00007F13590914CBh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373E84 second address: 373E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373E8B second address: 373E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373E91 second address: 373E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373E97 second address: 373E9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373E9B second address: 373EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1359094362h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 373EA9 second address: 373EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 340178 second address: 3401C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F1359094356h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1359094367h 0x00000010 jno 00007F1359094356h 0x00000016 popad 0x00000017 push edx 0x00000018 jmp 00007F135909435Bh 0x0000001d pop edx 0x0000001e pop edx 0x0000001f pop eax 0x00000020 pushad 0x00000021 pushad 0x00000022 je 00007F1359094356h 0x00000028 push edx 0x00000029 pop edx 0x0000002a pushad 0x0000002b popad 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 341C2D second address: 341C4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F13590914C6h 0x00000010 jmp 00007F13590914CDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 341C4A second address: 341C77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F1359094361h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F135909435Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F1359094356h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 341C77 second address: 341C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 341C7B second address: 341C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 37B1A6 second address: 37B1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 346CCC second address: 346CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 380589 second address: 38058E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38058E second address: 38059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 380CE1 second address: 380CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F13590914CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 380E94 second address: 380E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 380E9A second address: 380EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 380EA0 second address: 380EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381887 second address: 38188D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38188D second address: 3818D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 add dword ptr [esp], 7E6D4B6Fh 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F1359094358h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1DE4h], eax 0x0000002d jmp 00007F135909435Ah 0x00000032 call 00007F1359094359h 0x00000037 push ecx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3818D9 second address: 3818DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3818DF second address: 381900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1359094368h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381900 second address: 381905 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381905 second address: 381922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jl 00007F135909435Ch 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381922 second address: 381948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F13590914D6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381948 second address: 381952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F1359094356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381A1E second address: 381A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381A24 second address: 381A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381BB2 second address: 381BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F13590914DAh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F13590914D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381BEC second address: 381BF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 381E99 second address: 381E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 382531 second address: 382549 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 382928 second address: 382934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 382934 second address: 38293A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38293A second address: 38293F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3836B7 second address: 3836D9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F135909435Ch 0x00000008 jc 00007F1359094356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jc 00007F1359094358h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F1359094356h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 384743 second address: 384747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 384747 second address: 38474B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38474B second address: 384751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 384751 second address: 38476E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1359094369h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3872FF second address: 387346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 js 00007F13590914C6h 0x0000000b pop ebx 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 and esi, dword ptr [ebp+122D2A3Eh] 0x00000018 push 00000000h 0x0000001a mov si, cx 0x0000001d mov edi, dword ptr [ebp+122D2BFBh] 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 push ebx 0x00000026 pushad 0x00000027 popad 0x00000028 pop ebx 0x00000029 jmp 00007F13590914D8h 0x0000002e popad 0x0000002f push eax 0x00000030 push esi 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 387DCB second address: 387DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 387DD1 second address: 387E39 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F13590914D8h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F13590914C8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c sbb esi, 69C9DF69h 0x00000032 push 00000000h 0x00000034 xchg eax, ebx 0x00000035 jmp 00007F13590914D6h 0x0000003a push eax 0x0000003b push ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38C745 second address: 38C749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38D689 second address: 38D68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38E7F3 second address: 38E80C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F135909435Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38E80C second address: 38E811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38E811 second address: 38E816 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38EB1C second address: 38EB20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38EB20 second address: 38EB26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38EB26 second address: 38EB2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3928A2 second address: 3928D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F1359094363h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F1359094356h 0x00000012 jnp 00007F1359094356h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ecx 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 393197 second address: 39319D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39319D second address: 3931A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39420D second address: 39422E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007F13590914D2h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3931A1 second address: 3931B4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1359094356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 394FEA second address: 394FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3931B4 second address: 3931B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 394FF6 second address: 394FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39422E second address: 3942AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, 6A8D6292h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov bx, C921h 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 jmp 00007F1359094367h 0x00000026 mov eax, dword ptr [ebp+122D0FF5h] 0x0000002c mov ebx, ecx 0x0000002e push FFFFFFFFh 0x00000030 mov dword ptr [ebp+122D2F47h], ebx 0x00000036 nop 0x00000037 js 00007F135909436Eh 0x0000003d jmp 00007F1359094368h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3931B8 second address: 3931C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3942AE second address: 3942B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3931C6 second address: 3931CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3942B2 second address: 3942CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3931CB second address: 3931D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3960C8 second address: 3960DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F135909435Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3960DC second address: 3960E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 395182 second address: 395186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39616B second address: 396194 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jmp 00007F13590914CCh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39522D second address: 395232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 395232 second address: 39523C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F13590914C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39A122 second address: 39A153 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1359094358h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F135909435Dh 0x00000012 push 00000000h 0x00000014 and ebx, 652B9A00h 0x0000001a push 00000000h 0x0000001c clc 0x0000001d push eax 0x0000001e js 00007F1359094360h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39BF0C second address: 39BF22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F13590914C6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F13590914C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39BF22 second address: 39BF92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F1359094358h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov ebx, dword ptr [ebp+122D2CA3h] 0x00000028 mov bl, F2h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F1359094358h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 jng 00007F135909435Ah 0x0000004c mov bx, 8C3Bh 0x00000050 push 00000000h 0x00000052 push eax 0x00000053 jbe 00007F1359094368h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39BF92 second address: 39BF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39BF96 second address: 39BF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39844F second address: 398453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 398453 second address: 398459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 396313 second address: 3963D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F13590914C8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 clc 0x00000025 mov ebx, dword ptr [ebp+122D2CDBh] 0x0000002b push dword ptr fs:[00000000h] 0x00000032 jmp 00007F13590914D9h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e push edx 0x0000003f push esi 0x00000040 pop ebx 0x00000041 pop edi 0x00000042 mov eax, dword ptr [ebp+122D0381h] 0x00000048 jmp 00007F13590914D5h 0x0000004d push FFFFFFFFh 0x0000004f mov edi, eax 0x00000051 pushad 0x00000052 push ebx 0x00000053 mov ebx, dword ptr [ebp+122D1FC4h] 0x00000059 pop ebx 0x0000005a call 00007F13590914CFh 0x0000005f jmp 00007F13590914CEh 0x00000064 pop esi 0x00000065 popad 0x00000066 nop 0x00000067 jmp 00007F13590914D5h 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push edi 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39E04F second address: 39E07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F1359094366h 0x0000000d jmp 00007F1359094360h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3963D6 second address: 3963DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 343767 second address: 34376D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 34376D second address: 343773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39C0C7 second address: 39C0CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 343773 second address: 34377C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 34377C second address: 343780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39C0CB second address: 39C0DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jnp 00007F13590914D0h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39C0DD second address: 39C183 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D2323h], edi 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jns 00007F135909436Ch 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007F1359094358h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b or edi, 60B5A15Fh 0x00000041 mov eax, dword ptr [ebp+122D0879h] 0x00000047 call 00007F135909435Ah 0x0000004c mov edi, dword ptr [ebp+122D21E6h] 0x00000052 pop edi 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push ebp 0x00000058 call 00007F1359094358h 0x0000005d pop ebp 0x0000005e mov dword ptr [esp+04h], ebp 0x00000062 add dword ptr [esp+04h], 0000001Ah 0x0000006a inc ebp 0x0000006b push ebp 0x0000006c ret 0x0000006d pop ebp 0x0000006e ret 0x0000006f mov dword ptr [ebp+12454BB0h], esi 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jp 00007F1359094358h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39E6F8 second address: 39E6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 39E6FE second address: 39E76F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F1359094358h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 add di, 705Ch 0x00000028 jmp 00007F135909435Ah 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F1359094358h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 jmp 00007F1359094360h 0x0000004e push 00000000h 0x00000050 push ebx 0x00000051 or di, 36B2h 0x00000056 pop edi 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A6998 second address: 3A69C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F13590914C6h 0x0000000a jp 00007F13590914C6h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 jbe 00007F13590914C6h 0x0000001e popad 0x0000001f jno 00007F13590914C8h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A69C5 second address: 3A69C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A69C9 second address: 3A6A00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F13590914D2h 0x00000011 jns 00007F13590914C6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A6A00 second address: 3A6A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jnp 00007F1359094356h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A60F7 second address: 3A6103 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A6103 second address: 3A6109 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A6109 second address: 3A6127 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F13590914C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F13590914CCh 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A6548 second address: 3A654E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A654E second address: 3A6552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3A6552 second address: 3A6556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACC93 second address: 3ACCEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push esi 0x0000000a push edi 0x0000000b jg 00007F13590914C6h 0x00000011 pop edi 0x00000012 pop esi 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F13590914D7h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f jmp 00007F13590914D0h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F13590914D5h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACCEB second address: 3ACCEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACDA8 second address: 3ACDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACDAC second address: 3ACDB2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACDB2 second address: 3ACDDB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jng 00007F13590914F3h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F13590914D5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACDDB second address: 3ACE05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b ja 00007F135909435Ah 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACE05 second address: 3ACE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACED4 second address: 3ACEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACEE4 second address: 3ACEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3ACEE8 second address: 3ACEF2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1359094356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1622 second address: 3B1633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F13590914C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1633 second address: 3B1637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1637 second address: 3B1641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1641 second address: 3B1645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1C68 second address: 3B1C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1C70 second address: 3B1C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1DC2 second address: 3B1DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1F42 second address: 3B1F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1F48 second address: 3B1F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B1F52 second address: 3B1F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B237B second address: 3B23B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F13590914D8h 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F13590914D8h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B2524 second address: 3B2528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B2528 second address: 3B253F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B253F second address: 3B2545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B2545 second address: 3B2549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B2549 second address: 3B2570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094368h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jl 00007F1359094356h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B7C00 second address: 3B7C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B7C09 second address: 3B7C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B7C0F second address: 3B7C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B7C13 second address: 3B7C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B6BE0 second address: 3B6BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F13590914C6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F13590914C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B6BF5 second address: 3B6C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B6C0B second address: 3B6C39 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F13590914D2h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F13590914D4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B6F0F second address: 3B6F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 387B89 second address: 387B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B7487 second address: 3B749F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1359094364h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B749F second address: 3B74B1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F13590914C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jno 00007F13590914C6h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3B75F1 second address: 3B7609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F1359094356h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jng 00007F1359094356h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38A64C second address: 36AD7C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F13590914CCh 0x00000008 jbe 00007F13590914C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F13590914CDh 0x00000017 pop edx 0x00000018 nop 0x00000019 pushad 0x0000001a mov eax, dword ptr [ebp+12474012h] 0x00000020 mov ah, ch 0x00000022 popad 0x00000023 call dword ptr [ebp+122D1D48h] 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38A75B second address: 38A75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38A75F second address: 38A77A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AC7E second address: 38AC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AC82 second address: 38AC88 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AC88 second address: 38AC92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F1359094356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AC92 second address: 38AC96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AD60 second address: 38AD64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AD64 second address: 38AD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jno 00007F13590914C6h 0x00000011 jmp 00007F13590914D5h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AE8A second address: 38AE9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F135909435Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AEEC second address: 38AF4E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jnl 00007F13590914CEh 0x0000000e xchg eax, esi 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F13590914C8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 nop 0x0000002a jmp 00007F13590914D5h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F13590914D1h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38AF4E second address: 38AF58 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F135909435Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38B226 second address: 38B241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38B241 second address: 38B25F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1359094369h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38B25F second address: 38B2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F13590914C8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000004h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F13590914C8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e sub dx, 84DEh 0x00000043 nop 0x00000044 jne 00007F13590914D8h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e jl 00007F13590914C6h 0x00000054 pop edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38BA06 second address: 38BA0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38BA0A second address: 38BA1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F13590914CAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38BA1E second address: 38BA46 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push edx 0x0000000a mov dword ptr [ebp+12474012h], edi 0x00000010 pop edi 0x00000011 lea eax, dword ptr [ebp+124863F4h] 0x00000017 and edx, 221457BFh 0x0000001d push eax 0x0000001e jc 00007F1359094373h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38BA46 second address: 38BAAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F13590914C8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 or dword ptr [ebp+1244EBCEh], ecx 0x0000002c lea eax, dword ptr [ebp+124863B0h] 0x00000032 mov edi, dword ptr [ebp+122D1C9Fh] 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c jmp 00007F13590914CFh 0x00000041 push ebx 0x00000042 pop ebx 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38BAAA second address: 38BAAF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38BAAF second address: 36B8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D2331h] 0x00000010 call dword ptr [ebp+122D208Fh] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 36B8C1 second address: 36B8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F135909435Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 36B8CF second address: 36B8E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F13590914CCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C15F0 second address: 3C15F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C15F4 second address: 3C1607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1607 second address: 3C160E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C192C second address: 3C1932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1A86 second address: 3C1A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1A8C second address: 3C1AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F13590914C6h 0x0000000a popad 0x0000000b jo 00007F13590914D2h 0x00000011 jmp 00007F13590914CAh 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1AA9 second address: 3C1AD1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1359094358h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1359094368h 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1AD1 second address: 3C1AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1AD7 second address: 3C1AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1AE7 second address: 3C1AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1C1B second address: 3C1C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F1359094367h 0x0000000b jmp 00007F1359094361h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1C3B second address: 3C1C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1C41 second address: 3C1C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C1EFB second address: 3C1F01 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C207C second address: 3C2080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C2080 second address: 3C2084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C2084 second address: 3C208D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C208D second address: 3C2094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C65E8 second address: 3C65EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C6BCF second address: 3C6BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C6BD3 second address: 3C6BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C6D2A second address: 3C6D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F13590914C6h 0x0000000a jne 00007F13590914C6h 0x00000010 jmp 00007F13590914D4h 0x00000015 popad 0x00000016 push edx 0x00000017 jmp 00007F13590914CEh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C70EF second address: 3C70F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C70F3 second address: 3C70F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3C7861 second address: 3C787F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F135909435Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F135909435Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CAA63 second address: 3CAA67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CAA67 second address: 3CAA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1359094367h 0x0000000c jmp 00007F135909435Fh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pushad 0x00000015 jl 00007F135909435Ch 0x0000001b jo 00007F1359094356h 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CC3D6 second address: 3CC3F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914D8h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CC3F3 second address: 3CC3F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CC3F9 second address: 3CC40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CF248 second address: 3CF252 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1359094356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CF252 second address: 3CF258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CF258 second address: 3CF25C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CF25C second address: 3CF265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CEB21 second address: 3CEB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3CEB25 second address: 3CEB37 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F13590914C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F13590914CEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D3A18 second address: 3D3A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1359094365h 0x0000000f js 00007F1359094368h 0x00000015 jmp 00007F135909435Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2D32 second address: 3D2D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2D38 second address: 3D2D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2D3C second address: 3D2D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2D40 second address: 3D2D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2D4D second address: 3D2D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2D51 second address: 3D2D55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2EB8 second address: 3D2EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D2EBE second address: 3D2EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D3048 second address: 3D304C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D6059 second address: 3D605F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D6352 second address: 3D6358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D667C second address: 3D6680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D6680 second address: 3D6686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D6686 second address: 3D668C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D668C second address: 3D66C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F13590914C6h 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 jo 00007F13590914DCh 0x00000016 jmp 00007F13590914CCh 0x0000001b jmp 00007F13590914CAh 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jng 00007F13590914C6h 0x0000002b push eax 0x0000002c pop eax 0x0000002d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D66C5 second address: 3D66E0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1359094356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F135909435Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3D66E0 second address: 3D66E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DC0CF second address: 3DC0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F135909435Fh 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DC0EA second address: 3DC0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DC0F0 second address: 3DC0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DA8A3 second address: 3DA8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DA8A7 second address: 3DA8C5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1359094356h 0x00000008 jmp 00007F1359094364h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DA8C5 second address: 3DA8F7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F13590914E2h 0x00000008 jnc 00007F13590914C6h 0x0000000e jmp 00007F13590914D6h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F13590914CAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DA8F7 second address: 3DA902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F1359094356h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 38B51A second address: 38B59D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F13590914C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c ja 00007F13590914D6h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F13590914C8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dl, A9h 0x0000002f mov ebx, dword ptr [ebp+124863EFh] 0x00000035 sbb ecx, 7ABBD291h 0x0000003b add eax, ebx 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F13590914C8h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D2E73h] 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 push eax 0x00000061 pop eax 0x00000062 pop eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push ebx 0x00000066 pop ebx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DB2F9 second address: 3DB2FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DB2FF second address: 3DB31D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F13590914C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F13590914CEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DB31D second address: 3DB321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DB321 second address: 3DB32B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DB32B second address: 3DB32F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DB32F second address: 3DB333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DBD80 second address: 3DBDA6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1359094356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F1359094370h 0x00000010 jmp 00007F1359094364h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DBDA6 second address: 3DBDAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DBDAE second address: 3DBDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DBDB2 second address: 3DBDD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F13590914D1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3DBDD8 second address: 3DBDDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E3474 second address: 3E3479 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E3479 second address: 3E34A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F135909435Fh 0x0000000b jmp 00007F1359094368h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E4603 second address: 3E4607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E4607 second address: 3E4613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E4613 second address: 3E4617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E4617 second address: 3E461F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E7C1C second address: 3E7C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E7DB8 second address: 3E7DC2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1359094356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E7DC2 second address: 3E7DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F13590914C6h 0x0000000d jmp 00007F13590914D1h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E7DE2 second address: 3E7DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F1359094356h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E7DF1 second address: 3E7DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E7DF5 second address: 3E7DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E8268 second address: 3E827F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E827F second address: 3E8285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E8285 second address: 3E8291 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F13590914C6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E8535 second address: 3E8539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3E8539 second address: 3E8558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914CAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F13590914CBh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F46A6 second address: 3F46AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F46AB second address: 3F46B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F46B3 second address: 3F46E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F135909435Bh 0x00000007 jmp 00007F135909435Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1359094367h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F46E9 second address: 3F4703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F4703 second address: 3F4707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F4707 second address: 3F4714 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F13590914C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F501B second address: 3F501F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F501F second address: 3F5025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F5025 second address: 3F502A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F502A second address: 3F5030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F5030 second address: 3F5043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F135909435Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F5A58 second address: 3F5A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 jmp 00007F13590914D5h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F5A78 second address: 3F5A93 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1359094358h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F135909435Dh 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F6137 second address: 3F6141 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F13590914C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3F6141 second address: 3F6147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3FC8C6 second address: 3FC8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914D9h 0x00000009 jne 00007F13590914C6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 3FC443 second address: 3FC450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40954B second address: 40956E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F13590914C6h 0x0000000d jmp 00007F13590914D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40956E second address: 40957C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40957C second address: 409599 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F13590914C6h 0x00000008 jmp 00007F13590914CBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F13590914C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 409101 second address: 409105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 409105 second address: 40912A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F13590914D9h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40912A second address: 409136 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jc 00007F1359094356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40C36A second address: 40C382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F13590914CFh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40C382 second address: 40C38A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40C38A second address: 40C3BF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 jc 00007F13590914C6h 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F13590914D3h 0x00000019 jmp 00007F13590914CEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40C3BF second address: 40C3CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F1359094358h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40BE8E second address: 40BEA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F13590914CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jne 00007F13590914C6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 40C032 second address: 40C094 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094367h 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a js 00007F1359094356h 0x00000010 jmp 00007F1359094363h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 js 00007F135909437Fh 0x0000001e jnc 00007F1359094369h 0x00000024 pushad 0x00000025 jp 00007F1359094356h 0x0000002b pushad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 419E3E second address: 419E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 419E42 second address: 419E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F1359094378h 0x0000000d jnp 00007F135909435Ah 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 419E5D second address: 419E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 419E63 second address: 419E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 419E67 second address: 419E6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 41E9E2 second address: 41EA09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F1359094356h 0x0000000b popad 0x0000000c jmp 00007F135909435Eh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 je 00007F1359094356h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 41EA09 second address: 41EA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F13590914CBh 0x0000000d jnp 00007F13590914C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 41EA24 second address: 41EA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 41EA29 second address: 41EA2E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 41EA2E second address: 41EA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 428CC3 second address: 428CCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 4279CE second address: 4279DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007F1359094356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 4279DA second address: 427A07 instructions: 0x00000000 rdtsc 0x00000002 je 00007F13590914DBh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F13590914CCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 42C866 second address: 42C86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 42C5DB second address: 42C5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 4349E0 second address: 434A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F1359094368h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 43619B second address: 4361BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F13590914D4h 0x0000000b jp 00007F13590914C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 4361BD second address: 4361C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 43ED6E second address: 43ED7E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F13590914C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 43ED7E second address: 43ED82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 43EC17 second address: 43EC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 43EC20 second address: 43EC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 438536 second address: 43853C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 44CDB4 second address: 44CDEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F135909435Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007F135909435Ch 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c jc 00007F1359094356h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 44C94A second address: 44C94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 44C94E second address: 44C962 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1359094360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 44C962 second address: 44C967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 461173 second address: 46117D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1359094356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 46001C second address: 460020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460334 second address: 46034A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F135909435Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 46034A second address: 46034E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 46034E second address: 460352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 46092C second address: 460936 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460936 second address: 46093C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 46093C second address: 460940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460940 second address: 460963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F1359094365h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460963 second address: 4609A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F13590914D3h 0x00000009 popad 0x0000000a jmp 00007F13590914D7h 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 jmp 00007F13590914CCh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 4609A8 second address: 4609AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460CAB second address: 460CC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F13590914D4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460CC5 second address: 460CDB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F135909435Ch 0x00000008 jnl 00007F1359094356h 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F1359094356h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460E08 second address: 460E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460E0C second address: 460E41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F135909437Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460E41 second address: 460E67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F13590914D2h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jbe 00007F13590914C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460E67 second address: 460E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1359094356h 0x0000000a jmp 00007F135909435Bh 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F135909435Ch 0x00000018 je 00007F1359094356h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 460E97 second address: 460E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 465700 second address: 465706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 465706 second address: 46574A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnc 00007F13590914C8h 0x00000010 jmp 00007F13590914CAh 0x00000015 popad 0x00000016 nop 0x00000017 mov dword ptr [ebp+122D2A38h], edi 0x0000001d push dword ptr [ebp+122D22EEh] 0x00000023 push eax 0x00000024 mov dword ptr [ebp+122D2739h], ebx 0x0000002a pop edx 0x0000002b push 287B4CE7h 0x00000030 pushad 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 pop edx 0x00000035 je 00007F13590914CCh 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 466EB8 second address: 466EC8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1359094356h 0x00000008 jno 00007F1359094356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 466A7B second address: 466AA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F13590914D5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F13590914C6h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\LopCYSStr3.exe	RDTSC instruction interceptor: First address: 384105 second address: 384144 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1359094369h 0x00000008 js 00007F1359094356h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1359094367h 0x00000019 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Special instruction interceptor: First address: 1D7C4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Special instruction interceptor: First address: 1D50DE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Special instruction interceptor: First address: 38A826 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Special instruction interceptor: First address: 3FFFE0 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Code function: 0_2_001DC06C rdtsc

0_2_001DC06C

Source: C:\Users\user\Desktop\LopCYSStr3.exe TID: 572	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe TID: 572	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: LopCYSStr3.exe, LopCYSStr3.exe, 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110424118.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C46000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109344902.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: LopCYSStr3.exe, 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\LopCYSStr3.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\LopCYSStr3.exe	File opened: NTICE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	File opened: SICE
Source: C:\Users\user\Desktop\LopCYSStr3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\LopCYSStr3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\LopCYSStr3.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Code function: 0_2_001DC06C rdtsc

0_2_001DC06C

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Code function: 0_2_001BC1F0 LdrInitializeThunk,

0_2_001BC1F0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: LopCYSStr3.exe	String found in binary or memory: rapeflowwj.lat
Source: LopCYSStr3.exe	String found in binary or memory: crosshuaht.lat
Source: LopCYSStr3.exe	String found in binary or memory: sustainskelet.lat
Source: LopCYSStr3.exe	String found in binary or memory: aspecteirs.lat
Source: LopCYSStr3.exe	String found in binary or memory: energyaffai.lat
Source: LopCYSStr3.exe	String found in binary or memory: necklacebudi.lat
Source: LopCYSStr3.exe	String found in binary or memory: discokeyus.lat
Source: LopCYSStr3.exe	String found in binary or memory: grannyejh.lat
Source: LopCYSStr3.exe	String found in binary or memory: sweepyribs.lat

Source: LopCYSStr3.exe, LopCYSStr3.exe, 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: DdProgram Manager

Source: C:\Users\user\Desktop\LopCYSStr3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	5 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LopCYSStr3.exe	63%	ReversingLabs	Win32.Infostealer.Tinba
LopCYSStr3.exe	68%	Virustotal		Browse
LopCYSStr3.exe	100%	Avira	TR/Crypt.TPM.Gen
LopCYSStr3.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
sustainskelet.lat	unknown	unknown	false	high
crosshuaht.lat	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
aspecteirs.lat	unknown	unknown	false	high
sweepyribs.lat	unknown	unknown	false	high
discokeyus.lat	unknown	unknown	false	high
energyaffai.lat	unknown	unknown	false	high
necklacebudi.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://steamcommunity.com/my/wishlist/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://player.vimeo.com	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C46000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com:443/profiles/76561199724331900	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1:27060	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.steampowered.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/account/cookiepreferences/	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/mobile	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/	LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900))	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81	LopCYSStr3.exe, 00000000.00000003.2109260380.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110456689.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109200621.0000000000C46000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000002.2110525613.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109161928.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, LopCYSStr3.exe, 00000000.00000003.2109328652.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579788
Start date and time:	2024-12-23 09:08:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LopCYSStr3.exe renamed because original name is a hash value
Original Sample Name:	2fe4852f3f183f8c7c00ef70bf432147.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:09:03	API Interceptor	7x Sleep call for process: LopCYSStr3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	LNn56KMkEE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	VBHyEN96Pw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	LNn56KMkEE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	VBHyEN96Pw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LNn56KMkEE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	VBHyEN96Pw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	44EPDJT1V8.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	104.102.49.254
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.543395695400938
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LopCYSStr3.exe
File size:	2'906'624 bytes
MD5:	2fe4852f3f183f8c7c00ef70bf432147
SHA1:	8053e9d18e6ad8ebaafe8a9dd60d449114220e67
SHA256:	2a930563d17d930c161b091a30a0776025d9671de9a39da2179089000a74256d
SHA512:	e4c5b41255f50687077f7d1a4406b9fac6029988840c6ec4a98126c4d23231cca9246b9c9555743ce319e47b951af5a6f1ae5c16992531f18356495244a06202
SSDEEP:	49152:q+ODzy2PmE0i/936fPczjIDLJLeUha2yI7EOWspbLZuBTz:qDmE0i/96fPczjIXJLeUhaUEDspvZuBv
TLSH:	8ED53A93AC09B2CFE48A277D8967CD87696D03F64F204DD7A928B4797DA3CC112B5C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0/...........@..........................`/.......,...@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1358B8CA2Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	5b6092196e4cb9eeb132b8b9accb9c21	False	0.9973044199486302	data	7.9752924462904415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
awmwdrqo	0x54000	0x29e000	0x29da00	00d666ffcad65ad95982f76cd9d3dbcb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uovzuipz	0x2f2000	0x1000	0x400	db5f8f6cfaefb162b5f94d289d740957	False	0.8212890625	data	6.331316770034465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f3000	0x3000	0x2200	088faab136201a5729e6ea73a87f615e	False	0.09995404411764706	DOS executable (COM)	1.1391664139728235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T09:09:04.119725+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.5	54436	1.1.1.1	53	UDP
2024-12-23T09:09:04.265494+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.5	53061	1.1.1.1	53	UDP
2024-12-23T09:09:04.407874+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.5	50882	1.1.1.1	53	UDP
2024-12-23T09:09:04.555393+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.5	59622	1.1.1.1	53	UDP
2024-12-23T09:09:04.697134+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.5	50649	1.1.1.1	53	UDP
2024-12-23T09:09:04.837762+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.5	52048	1.1.1.1	53	UDP
2024-12-23T09:09:04.978083+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.5	60519	1.1.1.1	53	UDP
2024-12-23T09:09:05.119789+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.5	51672	1.1.1.1	53	UDP
2024-12-23T09:09:05.260803+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.5	54496	1.1.1.1	53	UDP
2024-12-23T09:09:06.965220+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.102.49.254	443	TCP
2024-12-23T09:09:07.691794+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49704	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 09:09:05.576756954 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:05.576806068 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:05.576905012 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:05.578119040 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:05.578130960 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:06.965064049 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:06.965219975 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:06.969688892 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:06.969702959 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:06.970031023 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.016582966 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.035784006 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.079330921 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.691831112 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.691857100 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.691889048 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.691910982 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.691936016 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.691962004 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.691993952 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.692014933 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.692038059 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.870287895 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.870352030 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.870425940 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.870454073 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.870467901 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.871223927 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.871236086 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.871272087 CET	49704	443	192.168.2.5	104.102.49.254
Dec 23, 2024 09:09:07.871409893 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.871444941 CET	443	49704	104.102.49.254	192.168.2.5
Dec 23, 2024 09:09:07.871480942 CET	49704	443	192.168.2.5	104.102.49.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 09:09:04.119724989 CET	54436	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:04.260961056 CET	53	54436	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:04.265494108 CET	53061	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:04.403328896 CET	53	53061	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:04.407874107 CET	50882	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:04.553814888 CET	53	50882	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:04.555392981 CET	59622	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:04.693840027 CET	53	59622	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:04.697134018 CET	50649	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:04.834321976 CET	53	50649	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:04.837762117 CET	52048	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:04.975250006 CET	53	52048	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:04.978082895 CET	60519	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:05.117197990 CET	53	60519	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:05.119788885 CET	51672	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:05.257740021 CET	53	51672	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:05.260802984 CET	54496	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:05.403239012 CET	53	54496	1.1.1.1	192.168.2.5
Dec 23, 2024 09:09:05.406523943 CET	55371	53	192.168.2.5	1.1.1.1
Dec 23, 2024 09:09:05.543459892 CET	53	55371	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 09:09:04.119724989 CET	192.168.2.5	1.1.1.1	0x60d	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.265494108 CET	192.168.2.5	1.1.1.1	0x3ade	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.407874107 CET	192.168.2.5	1.1.1.1	0x298c	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.555392981 CET	192.168.2.5	1.1.1.1	0x37ab	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.697134018 CET	192.168.2.5	1.1.1.1	0x942b	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.837762117 CET	192.168.2.5	1.1.1.1	0x37c4	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.978082895 CET	192.168.2.5	1.1.1.1	0x731f	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.119788885 CET	192.168.2.5	1.1.1.1	0xdce2	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.260802984 CET	192.168.2.5	1.1.1.1	0x8d3b	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.406523943 CET	192.168.2.5	1.1.1.1	0x3a3c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 09:09:04.260961056 CET	1.1.1.1	192.168.2.5	0x60d	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.403328896 CET	1.1.1.1	192.168.2.5	0x3ade	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.553814888 CET	1.1.1.1	192.168.2.5	0x298c	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.693840027 CET	1.1.1.1	192.168.2.5	0x37ab	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.834321976 CET	1.1.1.1	192.168.2.5	0x942b	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:04.975250006 CET	1.1.1.1	192.168.2.5	0x37c4	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.117197990 CET	1.1.1.1	192.168.2.5	0x731f	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.257740021 CET	1.1.1.1	192.168.2.5	0xdce2	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.403239012 CET	1.1.1.1	192.168.2.5	0x8d3b	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 09:09:05.543459892 CET	1.1.1.1	192.168.2.5	0x3a3c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.102.49.254	443	4148	C:\Users\user\Desktop\LopCYSStr3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 08:09:07 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 08:09:07 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 08:09:07 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=14725e4f9b355e3c28593a91; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 08:09:07 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 08:09:07 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Target ID:	0
Start time:	03:09:00
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\LopCYSStr3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LopCYSStr3.exe"
Imagebase:	0x180000
File size:	2'906'624 bytes
MD5 hash:	2FE4852F3F183F8C7C00EF70BF432147
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.7%
Total number of Nodes:	55
Total number of Limit Nodes:	4

Executed Functions

Function 0018ACF0 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&K M, xrefs: 0018ADBF
h? !, xrefs: 0018AFB3
Jk"m, xrefs: 0018ADF7
&wXy, xrefs: 0018ADD4
/O_q, xrefs: 0018ADC6
'sZu, xrefs: 0018ADCD
e7o9, xrefs: 0018AF9F

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: &K M$&wXy$'sZu$/O_q$Jk"m$e7o9$h? !
API String ID: 0-2986092683
Opcode ID: 2e3b9603acb919fc9682d76a9a1d13590f59cb4206ab61e24d3fe52e488d7d2a
Instruction ID: 1a9c8b7a7a3dea4e7ba10e9c7a7029960b4ed384b77e880bd4c74f0b5d1bcdac
Opcode Fuzzy Hash: 2e3b9603acb919fc9682d76a9a1d13590f59cb4206ab61e24d3fe52e488d7d2a
Instruction Fuzzy Hash: 090266B1204B01CFD324CF25D895B97BBF1FB49314F148A2CE5AA8BAA0D7B5A945CF50

Function 00188850 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00188AD2

Part of subcall function 0018B390: FreeLibrary.KERNEL32(00188AB8), ref: 0018B396
Part of subcall function 0018B390: FreeLibrary.KERNEL32 ref: 0018B3B7

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: FreeLibrary$ExitProcess
String ID:
API String ID: 1614911148-0
Opcode ID: caecfb687bfa5b201a7aa262e00ec1fbc38870075a37c58b14c79797d3d8601d
Instruction ID: a5e22a236d41ef244ba5a8566f0029ae5806e1f1daf5f648aa265176ae241a5f
Opcode Fuzzy Hash: caecfb687bfa5b201a7aa262e00ec1fbc38870075a37c58b14c79797d3d8601d
Instruction Fuzzy Hash: C05195B7F142280BD72CBAA98C467AA75878BC5710F1F813E5945EB7D6EEB48C0583C1

Function 001BC1F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(001BE31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 001BC21E

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 001BC767 Relevance: 1.3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,+*), xrefs: 001BC790

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: ,+*)
API String ID: 0-3529585375
Opcode ID: d418b03609089684d4695d2cc92984c77720c4c5d270cb3e609f40abcf7a7115
Instruction ID: e75946fb1dc9d5b18b4306d4176dfa3bde6fdda63c03ea3ea70ca2d1fc0fdb9f
Opcode Fuzzy Hash: d418b03609089684d4695d2cc92984c77720c4c5d270cb3e609f40abcf7a7115
Instruction Fuzzy Hash: 7F31A575B402119BEB18CF58CC96FBEB7B2BB49300F24912CD501A77D0CB75AC018B90

Function 0018B70C Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

o`, xrefs: 0018B74B

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: o`
API String ID: 0-3993896143
Opcode ID: 62ee5e7c0ab081827e6a461b21ac79752fb10e977a795b54d4d1433690a468a1
Instruction ID: 72d7cefdcb953aa548800c3bc30a258bb87e125685b75179c341a012c2d84c5a
Opcode Fuzzy Hash: 62ee5e7c0ab081827e6a461b21ac79752fb10e977a795b54d4d1433690a468a1
Instruction Fuzzy Hash: 9311C270218340AFC3009F65DDC1B6ABFE29BC2204F54983DE191972A1C675E9899B15

Function 00189C4A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23aed4d8cab9d5e8368d411a36e9b2eec1fff21b6d43e884e6bf2e6f0ff1224
Instruction ID: f29592a60a8e920e96d10d4611b1dbaa71aceab3d7bc0577d35831276cb9ca4b
Opcode Fuzzy Hash: b23aed4d8cab9d5e8368d411a36e9b2eec1fff21b6d43e884e6bf2e6f0ff1224
Instruction Fuzzy Hash: 49112271A893808FD300DF6899816ABBBD2EBD2300F08552CE0D2AB351C775990E8B06

Function 001BAAA0 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,001BC1D6,?,0018B2E4,00000000,00000001), ref: 001BAABE

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: bf33ec96c3b8527097b62fb06f7db56fc41a38736258e7873de2be46aabd7a30
Instruction ID: 524cc15d85c3ba7d68b7d0834d32889b53f26dcb39c886636193bd27c47472d8
Opcode Fuzzy Hash: bf33ec96c3b8527097b62fb06f7db56fc41a38736258e7873de2be46aabd7a30
Instruction Fuzzy Hash: 8CD01231506122FBC6101F74FC06B863B58EF09761F074861F4006B4B1C761DCD08AD0

Function 001BAA80 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,001BC1C0), ref: 001BAA90

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8dc8ec6ea590a24e3da8986038954bad064197f350a61b917802af974e4922d6
Instruction ID: 32b53f00f48ad8db6d94c69ab04db414abb0cec5a0b669483d0b6140aa0b928f
Opcode Fuzzy Hash: 8dc8ec6ea590a24e3da8986038954bad064197f350a61b917802af974e4922d6
Instruction Fuzzy Hash: 8CC09231146120BBCA143B2AFC0AFCA3F68EF59762F0644A2F504670B2C761ACD2CAD4

Function 001D850F Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 001D850F

Memory Dump Source

Source File: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6054f74e3e46ecbaf253e8a3f1309e933cd4a934b31ab527ea208af5bf7c4761
Instruction ID: 66c0fc0f8cac2dfb8b5edfd7ef1cbaec17040ee619527a4085a129aa0bc663bd
Opcode Fuzzy Hash: 6054f74e3e46ecbaf253e8a3f1309e933cd4a934b31ab527ea208af5bf7c4761
Instruction Fuzzy Hash: B6F090F2C0D368EFE7046A58DD4566D77ACEB10350F26041ADED19B340FBA62D109A92

Function 001D85B1 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 001D8A38

Memory Dump Source

Source File: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a81acc06297681ca9cf767e9c3bbb56d1aa3069f7a47032422bf948d595cc492
Instruction ID: 42696499b2c69a6a8aecaa0a5198c390d60dd9de9be8f90ee7d75d888a40dc5b
Opcode Fuzzy Hash: a81acc06297681ca9cf767e9c3bbb56d1aa3069f7a47032422bf948d595cc492
Instruction Fuzzy Hash: FAD0173060C609CBDB542F64E0093FD7B70EF04321F250A1AECA68AB80DB310C60DA1A

Non-executed Functions

Function 001A41C0 Relevance: 24.8, Strings: 19, Instructions: 1025COMMON

Download Yara Rule

Strings

=_%A, xrefs: 001A490C
#f!x, xrefs: 001A4BC3
7, xrefs: 001A4D00
o#M%, xrefs: 001A48C6
-^+P, xrefs: 001A4832
:JL, xrefs: 001A4BF5
6T, xrefs: 001A4D0A
A/6Q, xrefs: 001A48E4
<[5], xrefs: 001A4902
8JL, xrefs: 001A4800
?z=|, xrefs: 001A47D8
>N@, xrefs: 001A480A
5F6X, xrefs: 001A4C13
pIrK, xrefs: 001A4560
)Z*\, xrefs: 001A4828
$%, xrefs: 001A4257
%y, xrefs: 001A4D14
VaUc, xrefs: 001A459C
)Z/\, xrefs: 001A4C1D

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: #f!x$$%$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
API String ID: 0-2905094782
Opcode ID: ab954e7cb4dd837993c81446be9c0540d64c7faedd7e408b75ff90ea81789ad7
Instruction ID: 70e15ce624a3b181123fe78a3f8ee268a44b9ea6ebdad774017db0489e71ae74
Opcode Fuzzy Hash: ab954e7cb4dd837993c81446be9c0540d64c7faedd7e408b75ff90ea81789ad7
Instruction Fuzzy Hash: AD9285B59092298BDB24CF59DC987DEBBB1FB85300F2082ECD4596B350DB754A86CF81

Function 001A4380 Relevance: 23.4, Strings: 18, Instructions: 948COMMON

Download Yara Rule

Strings

=_%A, xrefs: 001A490C
#f!x, xrefs: 001A4BC3
7, xrefs: 001A4D00
o#M%, xrefs: 001A48C6
-^+P, xrefs: 001A4832
:JL, xrefs: 001A4BF5
6T, xrefs: 001A4D0A
A/6Q, xrefs: 001A48E4
<[5], xrefs: 001A4902
8JL, xrefs: 001A4800
?z=|, xrefs: 001A47D8
>N@, xrefs: 001A480A
5F6X, xrefs: 001A4C13
pIrK, xrefs: 001A4560
)Z*\, xrefs: 001A4828
%y, xrefs: 001A4D14
VaUc, xrefs: 001A459C
)Z/\, xrefs: 001A4C1D

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: #f!x$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
API String ID: 0-3225404442
Opcode ID: 8276a14264e1c5f4c655be3af159b2f04329495d5ee975c83569641534640567
Instruction ID: ebf03c7624521f3fd8e14131a2edb3b9bc01975c3ec4084c69a453b4b2b861e9
Opcode Fuzzy Hash: 8276a14264e1c5f4c655be3af159b2f04329495d5ee975c83569641534640567
Instruction Fuzzy Hash: 5C9296B5909229CBDB24CF59D8987DEBBB1FB85300F2482ECD4596B350DB745A86CF80

Function 001891B0 Relevance: 15.4, Strings: 12, Instructions: 368COMMON

Download Yara Rule

Strings

gn~b, xrefs: 0018927C
w!w4, xrefs: 001891F1
908#, xrefs: 001891E9
vm/;, xrefs: 001891D9
!+2j, xrefs: 001891C9
ne, xrefs: 00189209
O35 , xrefs: 00189240
>7;<, xrefs: 001891F9
$01;, xrefs: 001891E1
", xrefs: 0018931D
(7.A, xrefs: 001892DC
bblg, xrefs: 0018928C

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: !+2j$"$$01;$(7.A$908#$>7;<$O35 $bblg$gn~b$ne$vm/;$w!w4
API String ID: 0-1290103930
Opcode ID: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
Instruction ID: 0301969fc7efe80daef8a5d0b4ad7fd554228d1db3175ec01cb517a64d9c088b
Opcode Fuzzy Hash: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
Instruction Fuzzy Hash: 38A1D47024C3D18BC316DF7984A076BBFE1AF97314F584A6DE4D54B282D3398A0ADB52

Function 0033659C Relevance: 14.2, Strings: 10, Instructions: 1664COMMON

Download Yara Rule

Strings

i^z, xrefs: 00336D00
Nd~{, xrefs: 003365B8
t|aw, xrefs: 00336DA1
Vh5, xrefs: 00337490
[4V?, xrefs: 0033700A
l.}?, xrefs: 00336921
i]/m, xrefs: 00336F4D
W], xrefs: 003373EE
?Ew, xrefs: 0033711A
?t3 , xrefs: 003370BE

Memory Dump Source

Source File: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: ?Ew$?t3 $Nd~{$Vh5$W]$[4V?$i]/m$i^z$l.}?$t|aw
API String ID: 0-749514316
Opcode ID: 61108761f8257dc90aacf1bbc8a25b20b527adcb99d30e60106f10e9b8715a0f
Instruction ID: f048a9467d6e7c9a6a41a5019279de85a732046026c3a0ac01dde155231d2b57
Opcode Fuzzy Hash: 61108761f8257dc90aacf1bbc8a25b20b527adcb99d30e60106f10e9b8715a0f
Instruction Fuzzy Hash: C5B227F3A0C2049FE304AE2DEC8577ABBE9EB94320F16463DEAC5C7744E93558058697

Function 0034C12B Relevance: 10.4, Strings: 7, Instructions: 1607COMMON

Download Yara Rule

Strings

gwl, xrefs: 0034CCF8
%e?v, xrefs: 0034C75D
K{^, xrefs: 0034D02D
Jx, xrefs: 0034D11D
OQ=g, xrefs: 0034C1C2
r|Y, xrefs: 0034C204
wX1, xrefs: 0034CCEE

Memory Dump Source

Source File: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: %e?v$Jx$OQ=g$gwl$K{^$r|Y$wX1
API String ID: 0-2969035542
Opcode ID: 1e286d5e35e680618cd51d305366cbb08adb0210409bd141b908011e68ca62ac
Instruction ID: 0de80b16371131ca7e8a29b9e1e171247102b853fef475428b04f6b85a129135
Opcode Fuzzy Hash: 1e286d5e35e680618cd51d305366cbb08adb0210409bd141b908011e68ca62ac
Instruction Fuzzy Hash: 29B239F3A0C2049FE304AE2DEC8577ABBE5EF94720F16493DEAC5C3744EA3558058696

Function 00189580 Relevance: 7.9, Strings: 6, Instructions: 442COMMON

Download Yara Rule

Strings

\, xrefs: 0018978A
r, xrefs: 001895F4
+8=>, xrefs: 00189782
#4<7, xrefs: 00189772
PK, xrefs: 001899E1
Tiec, xrefs: 00189963

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: #4<7$+8=>$PK$Tiec$\$r
API String ID: 0-1906979145
Opcode ID: 712d64c883553555ff90a1fbfe04879047906e27f9203c31e7012b0e83063bde
Instruction ID: 3d776059533536565d9d09499a9f74d9b84bbeeb66f5141db56ccfbfedbc4270
Opcode Fuzzy Hash: 712d64c883553555ff90a1fbfe04879047906e27f9203c31e7012b0e83063bde
Instruction Fuzzy Hash: A4D12476A083408BC318DF25C89166FBBE2EFD1318F18992DF5E69B251D738C905CB92

Function 0023F073 Relevance: 5.2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

Strings

@F>|, xrefs: 0023F103
'#O, xrefs: 0023F212
4(7V, xrefs: 0023F205
\]Nj, xrefs: 0023F116

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: '#O$4(7V$@F>|$\]Nj
API String ID: 0-3939798448
Opcode ID: 0a23b20d7f23afffcb7facf368ddcc4c22495a1f710574def08153ee0a827167
Instruction ID: 8e59f47a387a60ca427627792741f26e762248ff1dd2c741b5e66cfed655f228
Opcode Fuzzy Hash: 0a23b20d7f23afffcb7facf368ddcc4c22495a1f710574def08153ee0a827167
Instruction Fuzzy Hash: 7B516CF3A093185BE314693DEC847A7B7D9DB94361F1A823DEB88D3B84E93A5C0142C5

Function 0026E4AA Relevance: 4.3, Strings: 3, Instructions: 540COMMON

Download Yara Rule

Strings

7I}v, xrefs: 0026EA0B
=e~w, xrefs: 0026EAA8
a({m, xrefs: 0026EA45

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: 7I}v$=e~w$a({m
API String ID: 0-1546918791
Opcode ID: 86530de258bda18aecca2831198a69020abd3f78664e0bd9a019d7ff5c38174a
Instruction ID: 87ff7798e86acd34be27f5625fc6f73b2b068f2c4e3ed0ed6fa4374b62192a52
Opcode Fuzzy Hash: 86530de258bda18aecca2831198a69020abd3f78664e0bd9a019d7ff5c38174a
Instruction Fuzzy Hash: 5F02EDF3F516204BF3045929DC983A6B687EBD4324F2F823C9B98AB7C5D97D9C064285

Function 00258414 Relevance: 4.3, Strings: 3, Instructions: 529COMMON

Download Yara Rule

Strings

OqXV, xrefs: 00258924
%!y, xrefs: 00258B30
P, xrefs: 002584E0

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: %!y$OqXV$P
API String ID: 0-519088643
Opcode ID: e1f632b0792a51e6cf42899f29b07ceac4a6995bcf57b473780655e64bffa9f3
Instruction ID: 53aed8f706780c4de827c8bf45bbbdcea90b9f90169f98f22369047c911fa4b7
Opcode Fuzzy Hash: e1f632b0792a51e6cf42899f29b07ceac4a6995bcf57b473780655e64bffa9f3
Instruction Fuzzy Hash: 4F02D1B3E106248BF3144D39DC5836AB696DBD4320F2F823C9E99A77C8D97E5D0682C5

Function 001F025A Relevance: 4.3, Strings: 3, Instructions: 501COMMON

Download Yara Rule

Strings

4Dnz, xrefs: 001F07B4
j_, xrefs: 001F083A
[, xrefs: 001F0460

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: 4Dnz$[$j_
API String ID: 0-1214464401
Opcode ID: 4d37e4f1a27b3645521b85fb489c51bb7b8a0e59217f08e82dd504eb01431c35
Instruction ID: 28c5bece451aecd82e00d844f37e8181f9f55b157b1c8545e5cf7c377a299fe6
Opcode Fuzzy Hash: 4d37e4f1a27b3645521b85fb489c51bb7b8a0e59217f08e82dd504eb01431c35
Instruction Fuzzy Hash: 9FF1ADF3F105244BF3188979CC583667683DBD5324F2F82389E99ABBC5D97E9C0A4284

Function 001A2510 Relevance: 4.2, Strings: 3, Instructions: 454COMMON

Download Yara Rule

Strings

<pr, xrefs: 001A2536
y./, xrefs: 001A2715
st, xrefs: 001A253E

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: <pr$st$y./
API String ID: 0-3839595785
Opcode ID: 93d678a8b7779aed41853d6474628d885632c15709c017aa60d46888675e1418
Instruction ID: 9950b6723fd2e35bd73ac975419f5326a9bcb8c8b99eb709246d54e787b2d690
Opcode Fuzzy Hash: 93d678a8b7779aed41853d6474628d885632c15709c017aa60d46888675e1418
Instruction Fuzzy Hash: 07C15A7AA043108BD7189F28C85267BB3E1EFE6314F19852DF99687382E778DD05C792

Function 0019D380 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

C], xrefs: 0019D471
34, xrefs: 0019D46A
|F, xrefs: 0019D40A

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: 34$C]$|F
API String ID: 0-2804560523
Opcode ID: 3286d4f8f9a7812911fe20759ce0edcb9d275fff4ebb447b8e73366e5e7c2089
Instruction ID: 33e536a23a33601f791ac67888663ebc915cd64eefcd9a25c49064705b2bff86
Opcode Fuzzy Hash: 3286d4f8f9a7812911fe20759ce0edcb9d275fff4ebb447b8e73366e5e7c2089
Instruction Fuzzy Hash: 0FC11FB59183118BDB24CF28C88166BB3F2FF95314F59895CE8D58B390E774EA05CB92

Function 001AC3FC Relevance: 4.1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

Strings

yszp, xrefs: 001AC689
A, xrefs: 001AC51C
Hnd, xrefs: 001AC440

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: A$Hnd$yszp
API String ID: 0-2830101580
Opcode ID: 3653ebb3b90ad71f9cec46cb505f0095890a88683f3862b08358ad33dc208402
Instruction ID: 18a9f2acfcb89cf5b5e16d851087c9ec63445511ede8a59319066f3d9a139d25
Opcode Fuzzy Hash: 3653ebb3b90ad71f9cec46cb505f0095890a88683f3862b08358ad33dc208402
Instruction Fuzzy Hash: ADA1AE7590C3D18BE735CF2984607ABBBE1AF97304F1889ADD4C99B382D77584068B92

Function 0019B2E0 Relevance: 4.0, Strings: 3, Instructions: 231COMMON

Download Yara Rule

Strings

+|-~, xrefs: 0019B306
_, xrefs: 0019B428
/pqr, xrefs: 0019B30E

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: +|-~$/pqr$_
API String ID: 0-1379640984
Opcode ID: e956e5176e4052cafeedd8358dc657e3a0e5856fb2c74c8741ef13f3e1d398b6
Instruction ID: c06eb638c5cf038e254f7bc5343c029f2f910084a910a2bbe66d9474a1a30f46
Opcode Fuzzy Hash: e956e5176e4052cafeedd8358dc657e3a0e5856fb2c74c8741ef13f3e1d398b6
Instruction Fuzzy Hash: DB81175561418015CB2CDF3488A3737BAE7AF96308B3D91BFC956CFA57EA38C2028745

Function 0019759F Relevance: 3.2, Strings: 2, Instructions: 671COMMON

Download Yara Rule

Strings

gfff, xrefs: 00197747
i, xrefs: 00197B2A

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: gfff$i
API String ID: 0-634403771
Opcode ID: ba0e658f12cb4ec19a7dbd493b2ee559f41aa6939e7e7cf73d2eecb13a225af4
Instruction ID: 97c627c35f73be531c2606db93e68e31860630f3d1e28c71c88c34d1228b1800
Opcode Fuzzy Hash: ba0e658f12cb4ec19a7dbd493b2ee559f41aa6939e7e7cf73d2eecb13a225af4
Instruction Fuzzy Hash: 4E027772A1C2118BDB28CF28D885BABBBD2EFD1310F1D842DD485DB292DB349945C782

Function 00184320 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 00184711
), xrefs: 0018439B

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: c8a44907478a316f42582dcd38fefe9e95a3335b1f0054c75d1a24d7b6326109
Instruction ID: b6e5f7aec8bc9c01fca33b7c7a04254babc243df1816024e26698bb31658dd84
Opcode Fuzzy Hash: c8a44907478a316f42582dcd38fefe9e95a3335b1f0054c75d1a24d7b6326109
Instruction Fuzzy Hash: 8BD1C0B15083459FD720EF18D845B5FBBE4AB94304F14492DF9989B382EB75DA08CF92

Function 001AA33F Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

d, xrefs: 001AA047
d, xrefs: 001AA10D

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: d$d
API String ID: 0-195624457
Opcode ID: 410972cf291c9ae0dfa0e978c6201c8d9433e0ff75ee790a8bd56996e8cc7789
Instruction ID: 6b6e3f139b44ffddfee9b9706dd56f6386516b4f41df200f1ed56b84a9434faf
Opcode Fuzzy Hash: 410972cf291c9ae0dfa0e978c6201c8d9433e0ff75ee790a8bd56996e8cc7789
Instruction Fuzzy Hash: 295138369083109BC314CF24D850A6BBBE2AB9A714F594A6DF8C9A7650D732DD44CB83

Function 00198591 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

P<?, xrefs: 00198590
P<?, xrefs: 00198680

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: P<?$P<?
API String ID: 0-3449142988
Opcode ID: 8c5b971e7d3b03c037e2f735081decfa9e1c1838481c009d851eabebe5521982
Instruction ID: ece1c44d21026c4184fde57ebed6b55fb641aa777d4044457590d8b88032fc1f
Opcode Fuzzy Hash: 8c5b971e7d3b03c037e2f735081decfa9e1c1838481c009d851eabebe5521982
Instruction Fuzzy Hash: 5A314976A48310EFDB208F98C885FBABBA6B796310F59C82DD5C9E7111DB70984487D3

Function 0034423C Relevance: 2.3, Strings: 1, Instructions: 1031COMMON

Download Yara Rule

Strings

nk?{, xrefs: 00344E9A

Memory Dump Source

Source File: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: nk?{
API String ID: 0-557250917
Opcode ID: f9f84b2c9312ef439cfce82b878d30ace5cebd7430e2ea42fa9adf165ec155df
Instruction ID: 80b3ebb344e9c7cf5cb44497b9cd73b716ed588d265561bd1cd3a7baceb0df8e
Opcode Fuzzy Hash: f9f84b2c9312ef439cfce82b878d30ace5cebd7430e2ea42fa9adf165ec155df
Instruction Fuzzy Hash: 3772B2F390C2109FE3046F19EC8567AFBE5EF94720F1A492DEAC893740E63558518B97

Function 003410D8 Relevance: 2.0, Strings: 1, Instructions: 725COMMON

Download Yara Rule

Strings

`.[M, xrefs: 0034165F

Memory Dump Source

Source File: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: `.[M
API String ID: 0-2039740999
Opcode ID: f190fc2bf6f1b680814b74994dc27dbc8228b4f5e52ba67bc763e44f4833d454
Instruction ID: 6757ae10f50dd5efb7f21501d882f6ed108c0fce167d13656cb46e3171897efa
Opcode Fuzzy Hash: f190fc2bf6f1b680814b74994dc27dbc8228b4f5e52ba67bc763e44f4833d454
Instruction Fuzzy Hash: 012225F360C214AFE3046E29EC8167AFBE9EF94720F16893DEAC4C7740E63558058697

Function 001BB1D0 Relevance: 1.9, Strings: 1, Instructions: 653COMMON

Download Yara Rule

Strings

f, xrefs: 001BB3F1

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 3fc3e0d73eee0c1ac979ef9a70f998598024972ef84689061b3c8824ec239f46
Instruction ID: 0eb83b1eb3d70c738c31adb8bce128f51440b1faf976ba37af457565dd7b3ca0
Opcode Fuzzy Hash: 3fc3e0d73eee0c1ac979ef9a70f998598024972ef84689061b3c8824ec239f46
Instruction Fuzzy Hash: 4A12D47060C3418FD714CF29C8D1AAFBBE5BB99314F288A2CE49597A91D7B0DC45CB92

Function 002A7148 Relevance: 1.8, Strings: 1, Instructions: 526COMMON

Download Yara Rule

Strings

Y:n+, xrefs: 002A77A8

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: Y:n+
API String ID: 0-3917430811
Opcode ID: c66dc9bfaa81af1dc49abac139523891b1a72e1ae7447e25d9e3473e4812b52b
Instruction ID: b1e31f428a280dd53f1806ce51938cd9bf9e13535562a917649c6dadceece1bb
Opcode Fuzzy Hash: c66dc9bfaa81af1dc49abac139523891b1a72e1ae7447e25d9e3473e4812b52b
Instruction Fuzzy Hash: 0A02CCF3F146104BF3085A29DC9837AB6D2EBD4310F2F863D9A899B7C4E97E5C058685

Function 002AA1AB Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

cB;, xrefs: 002AA59F

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: cB;
API String ID: 0-3186558700
Opcode ID: cea233befafc4c5680fb50257e7f5dda5542e33ffd76d73209109dde4b78e536
Instruction ID: 13c7accf56ffb58c184382e3eb1ac412a28e43851857f09dae1c8e0c13424027
Opcode Fuzzy Hash: cea233befafc4c5680fb50257e7f5dda5542e33ffd76d73209109dde4b78e536
Instruction Fuzzy Hash: 96F1D0F3F156144BF3049939DC883A6B692DBD4320F2B863CDB989BBC9E97E5C054285

Function 002DA270 Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

AS:, xrefs: 002DA775

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: AS:
API String ID: 0-3708562549
Opcode ID: 912a2b243060243597436389be1958685afdd7710c28a11babf80284d28de144
Instruction ID: 2aaca285f76ef90056927650c7736dd2439d6bd2d27ccf52c6b1de9a6cbbb15f
Opcode Fuzzy Hash: 912a2b243060243597436389be1958685afdd7710c28a11babf80284d28de144
Instruction Fuzzy Hash: 70F1EFF3F042148BF3449E69DC94376B692EB94320F2F863C9A98A77C0E93E5C058785

Function 001E655D Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

wM|m, xrefs: 001E655D

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: wM|m
API String ID: 0-526873269
Opcode ID: e70c6b185d4196d2ec07de04f1b5903fd167805edc460fc43c858aeeb6e2d39c
Instruction ID: d91000b31f46d747fb736af0e0957378a835e5695ece65f77749c1b22b028e53
Opcode Fuzzy Hash: e70c6b185d4196d2ec07de04f1b5903fd167805edc460fc43c858aeeb6e2d39c
Instruction Fuzzy Hash: D9F1F0B3F146214BF3544929DC98376B693EBD5320F2B863C9E88AB7C4E97E5C094385

Function 002A0275 Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

:r!5, xrefs: 002A029C

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: :r!5
API String ID: 0-864791079
Opcode ID: 99e3c8d989ad61d493834dcc6985b240c406d1d261d0773c22b7b31ecf489d74
Instruction ID: ce58a13a762510df92c0688731239275bcf5cb2978e22e9841e36707f2c40357
Opcode Fuzzy Hash: 99e3c8d989ad61d493834dcc6985b240c406d1d261d0773c22b7b31ecf489d74
Instruction Fuzzy Hash: 37B14CF3F116254BF3544839CD99366258397D5324F3F82788A9CABBCAD87E9D0A1384

Function 00188330 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

., xrefs: 00188389

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 8c746c26982de6f9a59fbb61169d07589f752979840675e3323f3a0eaf7af3f0
Instruction ID: 66b25602579bac723ca1c7f538714bf9fcd4f0f544cfc8ba1ee3fe2357b1ebbb
Opcode Fuzzy Hash: 8c746c26982de6f9a59fbb61169d07589f752979840675e3323f3a0eaf7af3f0
Instruction Fuzzy Hash: B0913B72E083524BC711EE2DC8C035AB7E5AB81350FA98A69E8D5D7395EB34DE414FC1

Function 002B027F Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

, xrefs: 002B0426

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ff08dc2f7664ff9ee090e42eea33e76de8fe65ffc845d0e7320f69edde93d219
Instruction ID: cc144bee0f403fe4ad47ea7b10b74f6e8b1e0290d5c53f056944d57512113826
Opcode Fuzzy Hash: ff08dc2f7664ff9ee090e42eea33e76de8fe65ffc845d0e7320f69edde93d219
Instruction Fuzzy Hash: 2C915AB3F111254BF3544E69CC58362B293ABD5320F3F81788A589B7C5DD7EAC0A9784

Function 002E4078 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

^, xrefs: 002E420E

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 041778b6c93148513b7532a6ac008308cffcfd8d3a6165999534a1f75605b702
Instruction ID: dab31f37262f45482be794f33f227acbab590a575499f06c2527360e1b524315
Opcode Fuzzy Hash: 041778b6c93148513b7532a6ac008308cffcfd8d3a6165999534a1f75605b702
Instruction Fuzzy Hash: 88815AB3E116264BF3644E68CC543A2B692EB95320F2F82788E8C6B7C1D93F5D4957C4

Function 0029450F Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

R, xrefs: 002945D1

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: fa63f42a90eb7c8d32ea7fd7fd1cded8db4a1069744a366d2cfd166cc6f76186
Instruction ID: 9e2ab85161327feefd005ec95eec30b80e0482054001ca4af2bfa1d66bea65b7
Opcode Fuzzy Hash: fa63f42a90eb7c8d32ea7fd7fd1cded8db4a1069744a366d2cfd166cc6f76186
Instruction Fuzzy Hash: C8818FF3F112254BF3544969CC683A266839BD5324F2F82788E5CAB7C5E97E9C0A53C4

Function 001AB170 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 001AB36E

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 588de57baee6568c27203dc7776ecfd138e4417dec5ed17d0fcad45f8bda20f6
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: E371D436A0C3954BDB14CE68D4C032EBBE2ABCB710F29852EE4959B393D335DD458782

Function 002EE4E7 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

^, xrefs: 002EE5D4

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 297e36255119a984998ee708d51e4307bd10057aa936d7e020ecbf7074f429c3
Instruction ID: 1ef352be6fe091dde6ba9abeeda906adec4dff124361ebc50f0f38ce632d02c7
Opcode Fuzzy Hash: 297e36255119a984998ee708d51e4307bd10057aa936d7e020ecbf7074f429c3
Instruction Fuzzy Hash: BD515AF3F115214BF3444939CD583622693D7E1321F2F82798B49ABBC9D97E9D0A5384

Function 001874F0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction ID: fb597bbd2368e9cced87a03b96d2bb18127f1b5d5e0e468aa3e363435c6d1566
Opcode Fuzzy Hash: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction Fuzzy Hash: F912E532A0C7118BC725EF18D8806ABB3E2FFC5315F29892DD9D597285E734EA51CB42

Function 001A91DD Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9d311f87a96f9c0ad4fda69c31288a69d23d511794be6f18787071d4f2c30e
Instruction ID: 244285aff1b03a3e70e4ac9ba24a0ecad8b8cebd8d95f7821500ed5ca220d99f
Opcode Fuzzy Hash: 3b9d311f87a96f9c0ad4fda69c31288a69d23d511794be6f18787071d4f2c30e
Instruction Fuzzy Hash: 2DF118B5E103258BCF24CF68C8916ABB7B2FF56310F198199D896AF355E7349C41CB90

Function 00216056 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3ace9041cce320422e2ed984247bc3ffc21db5fd9c0f5fa76fbcf5e81e8ac3
Instruction ID: e069baa3d3f79e336c53a48b6b916e3c724bf0ffbc5665798e1745f9adec6c11
Opcode Fuzzy Hash: 4d3ace9041cce320422e2ed984247bc3ffc21db5fd9c0f5fa76fbcf5e81e8ac3
Instruction Fuzzy Hash: C3F139E7FA07660BF75108B8DD88396188397A5324F2F8274CF5C6B7C6D8BE4D5A4284

Function 00195220 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6928a4fdac4214c90e0fff78ff97b3740d9bc956c0fee0063ce051fffae9f730
Instruction ID: 842d2e1e3ac7c03cd03a35fd15bd62a633b352cf213c77fcfa33d36ea5b309c4
Opcode Fuzzy Hash: 6928a4fdac4214c90e0fff78ff97b3740d9bc956c0fee0063ce051fffae9f730
Instruction Fuzzy Hash: 11D14671608300DBD7359F24D851AABB7E2FF92354F584A2DE4C99B3A1EB349940CB83

Function 002BE454 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a1e7d7f23cca4dd509c97f57aefad75c7445028084232c9ddfc373adbab8ac
Instruction ID: c4b016861e381fab6f8b12e01e9588c0bcb787e99c2bcbaeb40f8a15386639b1
Opcode Fuzzy Hash: 36a1e7d7f23cca4dd509c97f57aefad75c7445028084232c9ddfc373adbab8ac
Instruction Fuzzy Hash: 55E1E4F3F056148BE3145E29DC84366B7D2EB94310F2F863C9A889B7C5EA7E5C058785

Function 002CE3BC Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1aa04e1e052385f5316a02b669df6c3d1c11752f37c79430a2c00a61453c13b
Instruction ID: 75ec9aec90662168ee425d00e11b885efe85860a3adbbefb86827f5a653f7fc6
Opcode Fuzzy Hash: d1aa04e1e052385f5316a02b669df6c3d1c11752f37c79430a2c00a61453c13b
Instruction Fuzzy Hash: EFE1AFB3F1122547F3544979CC983726683EB95320F2F82388E99AB7C5DC7E9D0A5384

Function 002DC307 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95808cb5fb9c07c51e51030b91886df9e2d5b9b8f84c3b611f4e6267d64edbf
Instruction ID: 4c03c77ca9699557f601dc9fb8c5000363aa48f6ae1b762236041648976d2e1c
Opcode Fuzzy Hash: f95808cb5fb9c07c51e51030b91886df9e2d5b9b8f84c3b611f4e6267d64edbf
Instruction Fuzzy Hash: BDE1F5F3B042148BF7049E39DC94376B6D2EB99310F1A863CDA859B7C5E93E9C058785

Function 00252551 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2c72792c2f7dc8f0cb2958a380ee2d603cd6e9220b82590ccdd12119c6dba9
Instruction ID: e2232143d74833f9bf3c6baf4764f6ce262be23bddeed6c9e6202f0864761539
Opcode Fuzzy Hash: 8b2c72792c2f7dc8f0cb2958a380ee2d603cd6e9220b82590ccdd12119c6dba9
Instruction Fuzzy Hash: B8E156B3F115264BF3584939CD683B26683ABD5314F2F823C8B496BBC9DD7E5C0A5284

Function 00196263 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e120ba35d68e022b772aa5c36b668683dd988715698850d86073f1cc7f2c5550
Instruction ID: ec2510a70b8d21b86c6f4dfd317adcd1b66133ce824ef828bf0e3e3c44b97f09
Opcode Fuzzy Hash: e120ba35d68e022b772aa5c36b668683dd988715698850d86073f1cc7f2c5550
Instruction Fuzzy Hash: 3EC139726083419FDB24CF68D891BAFBBE2AB95310F19892DE4C9D7291DB34D844C792

Function 0022005E Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf55f3c60866db1a570ce77a49144b734c0f8aa3629a3c2d2d7fb9c87029ff9
Instruction ID: 45a8de2f23a69ee133c6ea451a35fcfafa64413304355e24a860fc87e33f6a91
Opcode Fuzzy Hash: fdf55f3c60866db1a570ce77a49144b734c0f8aa3629a3c2d2d7fb9c87029ff9
Instruction Fuzzy Hash: F1D18AA3F7192607F7A50868DC493A25A4297A1324F1F8275CE9CEB7C7C8BE8D5583C4

Function 002B8552 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf20d0481be1639bec1e0104e08e06003c8eac3d68282c00ebd01e3e06c67d04
Instruction ID: 70af3d3ffdf60a8781f0f631a0d94495ad6532c786929306bcf96f591ac34242
Opcode Fuzzy Hash: cf20d0481be1639bec1e0104e08e06003c8eac3d68282c00ebd01e3e06c67d04
Instruction Fuzzy Hash: F9D1E1B3F102204BF3445A39CC983B67A92EB94324F1B463CDE89AB7C5D97E5D099385

Function 0030E3BA Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607e99302d71b5a7321b07f11c6d77eb975d2ebe18cac6cb81d2000b58a64cd5
Instruction ID: 67e5a9e2ed13839a24374a109a8e327d436a4e35a23ac31960a2faeca2209839
Opcode Fuzzy Hash: 607e99302d71b5a7321b07f11c6d77eb975d2ebe18cac6cb81d2000b58a64cd5
Instruction Fuzzy Hash: 60D179B3F1162547F3544939CCA83626683ABD5310F2F82788E9D6B7CAEC7E5D0A5384

Function 002C044F Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cbfa64a9e712e4e2ba26d60793f7dc2f5de9d6de74e17448b085e25e60d1f8
Instruction ID: 98276712a6f11ece8c31ca40135fa0f0afe249a0792e48ee46efdbc30748b84c
Opcode Fuzzy Hash: 69cbfa64a9e712e4e2ba26d60793f7dc2f5de9d6de74e17448b085e25e60d1f8
Instruction Fuzzy Hash: 85D157B3F116254BF3584979CC58362A683ABD1324F2F82788E8D6B7C5DC3E5D0A52C8

Function 00311142 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cbc75535ad02b126020c493bf5838ba9395a1a760d3bf65de4705f5309d4753
Instruction ID: 9b3c2b1c336518dd60447a2c29fed3f6ece5bc63348622c4bc4fc173a269d62d
Opcode Fuzzy Hash: 9cbc75535ad02b126020c493bf5838ba9395a1a760d3bf65de4705f5309d4753
Instruction Fuzzy Hash: 5AC188B3F516254BF3584879CD683A265839BD5324F2F82788F9C6BBC5DC7E4C0A4284

Function 00286011 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3fc2c17a2a61db94aa6e45c8d464bbb1d5653bb9ab9b613472eeb59876fed4
Instruction ID: 012525ddb5a0e5d5cb02247fea4bea6f6624c1d9b4fd45bd8b1e5bbc4c4e8d6c
Opcode Fuzzy Hash: 4d3fc2c17a2a61db94aa6e45c8d464bbb1d5653bb9ab9b613472eeb59876fed4
Instruction Fuzzy Hash: C4C188B3F1122547F3484979CDA83A26283A7D5325F2F82788E5D6B7C9EC7E5C0A5384

Function 0020A4B8 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e313ff85b4c9a062ef3ab1937eb686d5f7da3a74bd741341ce3db878b5d56502
Instruction ID: edf665bbe84f0c8510193fc2d954ab95768d53d7cf7d9fd02652604472d3d669
Opcode Fuzzy Hash: e313ff85b4c9a062ef3ab1937eb686d5f7da3a74bd741341ce3db878b5d56502
Instruction Fuzzy Hash: 40C1ABF3F506254BF3584969CD983A1658397A5320F2F82388F9C6B7C6D87E5C0A53C4

Function 001BF330 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e32133b82f1e9222e4253d9b6fbeac0709720200cf9f37d7a0d60a82f856365d
Instruction ID: 49a9fb1a0e53ee87a31371dd7e78096197bd31d915f84caa62adeddbcc65f272
Opcode Fuzzy Hash: e32133b82f1e9222e4253d9b6fbeac0709720200cf9f37d7a0d60a82f856365d
Instruction Fuzzy Hash: DEB1F636A183118BC724DF28C8909ABB7E2FF99710F19857CE98697365E731DD42C781

Function 00209101 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9e10f90f0490780f70d38e75366011ad0cd69aac26363621ed4adee53cf3fc
Instruction ID: 4c098a929e98afc1ff04f5d02a532091c6acbfe2667f47cb9460b21d19664e3f
Opcode Fuzzy Hash: 1b9e10f90f0490780f70d38e75366011ad0cd69aac26363621ed4adee53cf3fc
Instruction Fuzzy Hash: CFC18BB3F116254BF7484D69CC683A23683EB95320F2F82788F896B7C5D97E5C495384

Function 002E1184 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a2157b1fe87b3124304e9c9d2b71061db8c73accb749d625bc13451c0d7b88
Instruction ID: 89debaa62540c1235b2aa0e28e41a1e7d67fd1e13cbf6e32ddf5efc9b6313a01
Opcode Fuzzy Hash: 45a2157b1fe87b3124304e9c9d2b71061db8c73accb749d625bc13451c0d7b88
Instruction Fuzzy Hash: A3C15AF3F2152547F398483ACD59362658397D1325F2F82788E9CABBC9DC7E8D0A5284

Function 002FE1DC Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268a1532db8ae421c77f8af017dd4bc47ff7751e982fc5b06f3f078d204479a8
Instruction ID: c9e2cebed5601f4c0e829176ac51945217f3e32fbe2ebd6c801409f3e2525d39
Opcode Fuzzy Hash: 268a1532db8ae421c77f8af017dd4bc47ff7751e982fc5b06f3f078d204479a8
Instruction Fuzzy Hash: 86C17BB3F1122547F3544879CD983A26683DBD5324F2F82788E5C6BBCAD87E9D0A5384

Function 003043F3 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559b1a94f2d225675a4ebcfee8255a4f9b0941ca7353518a67e0643dda665065
Instruction ID: 316721501202cee78d3b7002f7fa76a00682e51e094042d3f6bb306809868ef7
Opcode Fuzzy Hash: 559b1a94f2d225675a4ebcfee8255a4f9b0941ca7353518a67e0643dda665065
Instruction Fuzzy Hash: 53C18FB3F512254BF3584939CD983626683DBE1325F2F81388B89A77C9EC7E5C0A1384

Function 002271E8 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998dd69a7b5cc08a68b7378a138023af8703138b45e496a50263231ffb1719f1
Instruction ID: 9f3b9ac78cfbb7da9dbcdde9a8d5ebb78a3cce4c6950e7ab64906e2cab91dd2a
Opcode Fuzzy Hash: 998dd69a7b5cc08a68b7378a138023af8703138b45e496a50263231ffb1719f1
Instruction Fuzzy Hash: E7C169F7F5162547F3880839DD983A26583A7E5320F2F82388B9D6B7C5DC7E9C0A4284

Function 0026A207 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d6c0b1a48629c5d2586e1ba274a85190e16bcc57c7aa5b7178eaaa383e6ffc
Instruction ID: a3959e2fcd034296a10f535b55649e1e7ac94193bef54c92fd16f1b99477287a
Opcode Fuzzy Hash: a7d6c0b1a48629c5d2586e1ba274a85190e16bcc57c7aa5b7178eaaa383e6ffc
Instruction Fuzzy Hash: 53C18DF3F2122547F3544D38CD683A26683DB91320F2F82388F996BBC9D97E5D465288

Function 002080B4 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fbb051ec2bcd2f46bc32641a84c3dd57a1da6f36cdc2ae2b2d9b349a41b416
Instruction ID: 6e27f1dcb8c9a7f7745cf1db8f6dec7dbbd2f74e76adce64cccf7307b4a36663
Opcode Fuzzy Hash: b8fbb051ec2bcd2f46bc32641a84c3dd57a1da6f36cdc2ae2b2d9b349a41b416
Instruction Fuzzy Hash: EEC15FB3F116264BF3444D29CCA83766683EBD5325F2F81388A899B7C6DD7E9C065384

Function 00298583 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ae0994841c6e35a1e1356b0ee3c1f2da15824783c35402b0a770d8f55f7f07
Instruction ID: 30d7950cd700d56dcb1129fac2f67a0bbb990dc3c0c0b6c0a3894a9a38b868b4
Opcode Fuzzy Hash: a9ae0994841c6e35a1e1356b0ee3c1f2da15824783c35402b0a770d8f55f7f07
Instruction Fuzzy Hash: DDB18DB3F111254BF7584D38CD693B26683AB95320F2F823D8B8AAB7C9DC7E5D055284

Function 001E8271 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ee8e1e71ed21eb99be7a9c1a78f242aac71e7e58aee3736edf82ffb82c24e2
Instruction ID: 35dea53aed05138796200a731e84229e7cd1cee8acfd60b34218a233f23038bd
Opcode Fuzzy Hash: 06ee8e1e71ed21eb99be7a9c1a78f242aac71e7e58aee3736edf82ffb82c24e2
Instruction Fuzzy Hash: 0EB16BB3F116214BF3544869CC983A26683DBD5320F2F81798E8DAB7CADD7E5D0A5384

Function 002740FA Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8572eb829f8b2b5e88a72fe5b7e584128179c8cf119baf9920bf419d3edffc07
Instruction ID: 4bc58444afabac71a489a5e75eabee66e7cca7a39a9f475821f7db31df4b60aa
Opcode Fuzzy Hash: 8572eb829f8b2b5e88a72fe5b7e584128179c8cf119baf9920bf419d3edffc07
Instruction Fuzzy Hash: 94B18DF3F112254BF3584978CDA83B26683DB95320F2F82788B59AB7C5D87E5D0A5384

Function 001EC4D4 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32054e1abf99379183f689069e49bbb09b8536c98f47464ac70702813804020a
Instruction ID: 8c44fb2c11281760017fd517bc5eb6ea13a82c1ce45619348c1ae450a30860fc
Opcode Fuzzy Hash: 32054e1abf99379183f689069e49bbb09b8536c98f47464ac70702813804020a
Instruction Fuzzy Hash: 8EB18DF3F2162507F3588969DC983A26583DBD5324F2F82788E5CAB7C5D87E9C065384

Function 001A2190 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582d5c17e2408607cfba6ac8d5988582d544dfb0d0b10db55677539d07c85583
Instruction ID: ac575d6fe8f281e3c5a636c4427377107fff6eb1adec513317abd80c6c5b8b77
Opcode Fuzzy Hash: 582d5c17e2408607cfba6ac8d5988582d544dfb0d0b10db55677539d07c85583
Instruction Fuzzy Hash: CC9133B6A043019BD7249F28CC92B7BB3A5EF96318F05482CE9869B381E775E904C752

Function 001FC556 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d4f6c6b3edab5cbfa33a06d08a686cbd25c8678fbcf5cd6fcfa50197a3e13e
Instruction ID: 7b2c413317d43ff888d26ca3748ee7291d6ed77b17393fb339de22b06531ba80
Opcode Fuzzy Hash: 55d4f6c6b3edab5cbfa33a06d08a686cbd25c8678fbcf5cd6fcfa50197a3e13e
Instruction Fuzzy Hash: 09B18BB3F1122547F3480929DDA83A27A43EBD5314F2F82788B896B7C5DD7E9C0A5384

Function 0024B139 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac17264d03608e7f162310261471dd43228c3b7e3687a70181e37188cf754b79
Instruction ID: ed71a3299c67c9e0ea17d88bdda51219c62c9a0466d4e88693a42e51671ee2d1
Opcode Fuzzy Hash: ac17264d03608e7f162310261471dd43228c3b7e3687a70181e37188cf754b79
Instruction Fuzzy Hash: 8BB1D3B7F116214BF3444D79DD483626A83DBD5314F2F82788A489BBCADCBE9D0A5384

Function 002D2377 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fead54d7a3a41a10c269d362dd8cc0cb6c6b0714f58f1a24b8ae4dd8c49f8254
Instruction ID: df9d86c2844fa8c954a1e111f732ddf9fd38d41dda471c29098cc387b200f111
Opcode Fuzzy Hash: fead54d7a3a41a10c269d362dd8cc0cb6c6b0714f58f1a24b8ae4dd8c49f8254
Instruction Fuzzy Hash: B4B19BF3F1162547F3584879CD683626683DB95324F2F82788F59AB7C9E87E9C0A42C4

Function 001EE3A1 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e083425faab076b9defd016d4424c872ec54b4524bbe0ce8f51080f826c3e80
Instruction ID: 8288aaed29864094df71db95c4ade46946bb0e1c4377d66f0a374733244e3924
Opcode Fuzzy Hash: 0e083425faab076b9defd016d4424c872ec54b4524bbe0ce8f51080f826c3e80
Instruction Fuzzy Hash: 07B15CF3F116254BF3884839CD5936225839BE5324F2F82398B9D9B7C9EC7D990A5384

Function 00240462 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bfcc4a83b83014a40122c3eeeaa74839c0dcb1df28809f664b721735f6355b
Instruction ID: c5954f8fddcc5a5e117e10157c6b5b85af3cd2e40a5d6a6115efff85ec47806a
Opcode Fuzzy Hash: 48bfcc4a83b83014a40122c3eeeaa74839c0dcb1df28809f664b721735f6355b
Instruction Fuzzy Hash: 85B1AFF7F6162547F3884878DD993622583D795315F2F82388F49AB7C6DC7E8C0A5288

Function 0026644A Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731f099e83b3221f01af9214f4267453176ea64398748b2230f3bf4c4b9f8893
Instruction ID: 5b9677d2f4cc8779cc9fcd6299ab13ddf51bd61d8f26f15a57103534731b418c
Opcode Fuzzy Hash: 731f099e83b3221f01af9214f4267453176ea64398748b2230f3bf4c4b9f8893
Instruction Fuzzy Hash: 2BB16DB3F1162547F3584939DC583626583DBE1321F2F82788E9CAB7C5D87E9D0A5384

Function 0027E04B Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85bea5aae736551a8b82667074204ebc5ad1a2cca212bd8f51ab997b2549ece
Instruction ID: 2bec001347db3278a247560b6aa296380e13e02057953cd08845bfc83630107e
Opcode Fuzzy Hash: a85bea5aae736551a8b82667074204ebc5ad1a2cca212bd8f51ab997b2549ece
Instruction Fuzzy Hash: 43B1A0F3F2062547F7584869DD983726683DBD5311F2F82388F599B7C6D8BE9C094284

Function 0025100C Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dccb2ee6717cf2cb536c0804a471f2facf80af29dd8e8a1849d00ea50cf24ae
Instruction ID: 6e6f7b448edb579c2cd5c5a6e3a94212d6106518f2ef081c9a9c0473c6e2f764
Opcode Fuzzy Hash: 4dccb2ee6717cf2cb536c0804a471f2facf80af29dd8e8a1849d00ea50cf24ae
Instruction Fuzzy Hash: 99B17FF7F213254BF34448B9CD983626582D795311F2F82788F58AB7CAD8BE5D0A5388

Function 002DB158 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7708440ef48b8b7e08a79d619112caa28e65ebe1f0846bcb159c4eed1978ce3b
Instruction ID: 9ceb2e25702d94a106fa2575fb1796378ff7434ce6a0f9dc83daf9cb43c1b6c1
Opcode Fuzzy Hash: 7708440ef48b8b7e08a79d619112caa28e65ebe1f0846bcb159c4eed1978ce3b
Instruction Fuzzy Hash: 0CB188B7F116254BF3544839CD883626683D7D5324F2F82388F686BBCAD87E9D0A5284

Function 002AC467 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8165fa4233cba35224995537b1c0bfa3b9fe87cb16fe97b445f901ed8317ef
Instruction ID: 3c575c66b840dee3beb094633d231c8d2ae8731e589dbf06be93788ced68f0f6
Opcode Fuzzy Hash: ca8165fa4233cba35224995537b1c0bfa3b9fe87cb16fe97b445f901ed8317ef
Instruction Fuzzy Hash: 23A1ABB3F106254BF3540D68DCA83A26683DBA5324F2F42788F5CAB3C6D97E5D0A5384

Function 00186280 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction ID: 71095e4602ddbe10cee227c4fb783c502f10d2428f8387d342792d9a4a9c46af
Opcode Fuzzy Hash: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction Fuzzy Hash: 51C158B2A087418FC360DF28DC96BABB7F1BF85318F08492DD1D9C6242E778A155CB06

Function 00259056 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7585dd088c1ab066db9bdd8912a8f54af6179f915b0f3aaade97ecff2aff9e0
Instruction ID: 5693d46df19fcbf53d597ba16e560d7f189670bfda0d0f2964d39e430a8590c1
Opcode Fuzzy Hash: b7585dd088c1ab066db9bdd8912a8f54af6179f915b0f3aaade97ecff2aff9e0
Instruction Fuzzy Hash: 60A17CB3F2162547F3584868DCA83A66683D7D1324F2F82388F59AB7C6D97E9D0643C4

Function 001A830D Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6f764456664bf1e25c64f8412d775975d167a3902bc90c350e2edc3d0d15f1
Instruction ID: c6d5776bbea1b48d1190512878a902d51c41022d309add7c6b38908c739fab40
Opcode Fuzzy Hash: 7a6f764456664bf1e25c64f8412d775975d167a3902bc90c350e2edc3d0d15f1
Instruction Fuzzy Hash: 8F914B76A5470A4BC718DE6CDC9066DB6D2ABD5210F4D823CE8968B3C2EF74ED0987C1

Function 002E2141 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17e1f01bb34d7d27cc0bfe69ea3a51cb5ec514197119c1d125e6209526fd03b
Instruction ID: 6d7df80efe0921a388bd80f9048a6302d91558c3b6076bba3bbf06a5e74ce4d3
Opcode Fuzzy Hash: b17e1f01bb34d7d27cc0bfe69ea3a51cb5ec514197119c1d125e6209526fd03b
Instruction Fuzzy Hash: A9A1ACB3F2122147F3584929DCA83627683EBD5321F2F82788B596B7C9DD7E5D0A4384

Function 003022EE Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716acace4a28e813296c199c582fe266a529c853f97e96d10a2200ec0035ffb7
Instruction ID: b48d5a864dcba9e1b1f7dd19e4cc03835d1ca141f857e681a786b6545de63b9e
Opcode Fuzzy Hash: 716acace4a28e813296c199c582fe266a529c853f97e96d10a2200ec0035ffb7
Instruction Fuzzy Hash: 47A18EF3F116254BF3444939CC683B26682DB95324F2F82788E59AB7C6DC7E9D0A5384

Function 001F2317 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30cd4a77c9998d85bdb9dc0f23f6394f41233486f6b3b168d8528f9ad53fa8e
Instruction ID: dc086119c4e69f2b6e836ef519a2341c4bbd7dedc20c58616f1b52be333662c9
Opcode Fuzzy Hash: a30cd4a77c9998d85bdb9dc0f23f6394f41233486f6b3b168d8528f9ad53fa8e
Instruction Fuzzy Hash: 30A19CF3F116154BF3484939DC983626683EBE5321F3F82388B589B7C9E97E9D0A5244

Function 0030A222 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd459f5ba06a20db5b74a06a8c1c1981e90eec187d46022e55dc69cbc5b0e11
Instruction ID: 44c41c3da630470f79633218a08a326acb1f7166d5137ea9e249866fadddce19
Opcode Fuzzy Hash: 6bd459f5ba06a20db5b74a06a8c1c1981e90eec187d46022e55dc69cbc5b0e11
Instruction Fuzzy Hash: 3FA178F7F5162107F3584878DDA83A225839BD5325F2F82788F5C6B7C6E87E5D0A4284

Function 00283093 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514f3bd2744624e0f47d55fa5ca2d01cc1f4db5c81e4e7ee72e536e5b3b570a7
Instruction ID: a8b11c4a18a3b5248c04be2bae3291b961e242e0109306c65474a2787feac4d7
Opcode Fuzzy Hash: 514f3bd2744624e0f47d55fa5ca2d01cc1f4db5c81e4e7ee72e536e5b3b570a7
Instruction Fuzzy Hash: 73A17BF3F502254BF3544978CD983A26583EB95320F2F82788E5C6BBCAD87E4D0A5384

Function 0027E571 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebcd0a910f02e90d4279add0ab0f4d4406ee2a6bf381844b2413f81c09a29df
Instruction ID: 4b5d5d862def78c7069d70adfc0f0859828d8a7aa9a1d8b41949a907969dc307
Opcode Fuzzy Hash: 6ebcd0a910f02e90d4279add0ab0f4d4406ee2a6bf381844b2413f81c09a29df
Instruction Fuzzy Hash: DAA18CB7F106260BF3484939DDA83726683DBD5310F2F82788F596BBC6D87E5D0A5284

Function 0022442D Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56da168fe830bbed1f83822b2f2b5976dbaa5e252a02ad21ee97e517197b5aa9
Instruction ID: e950e5e5d6f696f66b991fb42e457bfbb087cc8fb6854af69e22b4665b46bfe2
Opcode Fuzzy Hash: 56da168fe830bbed1f83822b2f2b5976dbaa5e252a02ad21ee97e517197b5aa9
Instruction Fuzzy Hash: 2EA17DB3F512254BF3444879CDA93A26583DB95320F2F82788F99AB7C6DC7E5C0A5384

Function 002DF1EA Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac49d7b58e112fcd16798cdd5ef9cb3c03be2762efb6e7451d5f3a45e2cdcc68
Instruction ID: f1bb86d9841a9f604360e9734d9e9b1d7ec1e416437e6db44d1700edb3689e4c
Opcode Fuzzy Hash: ac49d7b58e112fcd16798cdd5ef9cb3c03be2762efb6e7451d5f3a45e2cdcc68
Instruction Fuzzy Hash: EDA19BB3F111254BF3544D65DC983A17683ABD6324F2F42788E8C6B3C5D97E6C4A9384

Function 0030B07D Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251b8b2975877b6613da04bae7d95a80413b7017dfc679abc4acbf4f0b54f1a7
Instruction ID: 469d15ec21a6b619559173d025da99cb9f60d459c883e8b152dc6b52e0c656c2
Opcode Fuzzy Hash: 251b8b2975877b6613da04bae7d95a80413b7017dfc679abc4acbf4f0b54f1a7
Instruction Fuzzy Hash: 78A15BB7F125264BF3404969DC483A1B693ABD5324F3F81388B4C6B7C5EA3E9D065388

Function 002DE2C6 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814a3c4df553500f12a04b031756f24701674123e28b1547e1d0dcc36c3179bc
Instruction ID: a7345d98808f55f0352be91ef09b08d46df9e11b6103068e499c95e5b0052802
Opcode Fuzzy Hash: 814a3c4df553500f12a04b031756f24701674123e28b1547e1d0dcc36c3179bc
Instruction Fuzzy Hash: 5BA19EF3F615254BF3544D29DC583A172839BD5324F2F82798A8C5B3C6D87E9C4A5384

Function 0020C0B9 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6c1dcd2b179470fe14dec64f41c70e61ffb98136813bb7ec875afdbf840e8f
Instruction ID: df319fe63db1062b245d12cae81d86073d851bdfc2018b707d0743fa3dce26a4
Opcode Fuzzy Hash: ef6c1dcd2b179470fe14dec64f41c70e61ffb98136813bb7ec875afdbf840e8f
Instruction Fuzzy Hash: 86A17CF3F112254BF3584979CC983626683ABD1324F2F82788E886B7C5DD7E5C0A5384

Function 0025A197 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa5fcffd3f574c1bb621173b32dafe39e2411f6f40737cab979bcdf455fe44c
Instruction ID: 15c94fcd8b2d232d5e2728ffa7473d34690824122c379ab0e27f6f2e256c3da0
Opcode Fuzzy Hash: eaa5fcffd3f574c1bb621173b32dafe39e2411f6f40737cab979bcdf455fe44c
Instruction Fuzzy Hash: 0FA178B3F112254BF3584D78CCA83726692DB95320F2F827D8E89AB7C5DD7E5C095284

Function 0022B1B2 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32fd1c4de698c48572e5f308c7b402b7b62ad300e271d768744a68c265e9d316
Instruction ID: 03d835b36306e666c93682ec08d23a3176c28fc466919c1a998b83bf202fce85
Opcode Fuzzy Hash: 32fd1c4de698c48572e5f308c7b402b7b62ad300e271d768744a68c265e9d316
Instruction Fuzzy Hash: A9A1A2B3F102254BF3544E69CC943B17292EB95310F2F867C8E88AB7C5D97EAD099384

Function 00260207 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eac9cee9ea7e53be71df0064cff7d64503823dd9a1e118c697b3ff326ff1d42
Instruction ID: f0eec7a04a443570932bb05d9b1c275c40f47425c1a21a3eed140488caf0c284
Opcode Fuzzy Hash: 6eac9cee9ea7e53be71df0064cff7d64503823dd9a1e118c697b3ff326ff1d42
Instruction Fuzzy Hash: B1A149F3F2162547F3544929CC683626683DBE1320F2F82798B99AB7C5ED7E9C065384

Function 00298119 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b6c73df140d93aa68f17cd6d0d7c4654fbc63fd425c5eaf60761b576df4898
Instruction ID: a74d6bf35c3c979f63362aa6f8870e2aa74dacc444ab6713179fdb3a01dcc284
Opcode Fuzzy Hash: 23b6c73df140d93aa68f17cd6d0d7c4654fbc63fd425c5eaf60761b576df4898
Instruction Fuzzy Hash: 2AA189B3F116254BF3484969CC98362B683EB95314F2F817C8F896B7C5E97E5C0A5384

Function 0029C553 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee0216e01da05b1ccdb35af306a675efaa9d9ebf930ec77cff79fe5bf7643ed
Instruction ID: 83c14a4f1e9826c2d281cd6eae478639aba518faa7671e49a58fdfc4b748974f
Opcode Fuzzy Hash: 5ee0216e01da05b1ccdb35af306a675efaa9d9ebf930ec77cff79fe5bf7643ed
Instruction Fuzzy Hash: 74A154F3F116254BF3544928CC5836262839BA5324F2F82788F9C6B7C6E93E9D0653C8

Function 0020F03B Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea04846037cc93d2e5326b188e2f1bf83c0e9cee961dc651f45cfbc8a88c6e3
Instruction ID: 66be6374e9caafb0406dadfaeb2d6e5631f5fdb12c6a66bf4d93b6cda8f7bf84
Opcode Fuzzy Hash: 6ea04846037cc93d2e5326b188e2f1bf83c0e9cee961dc651f45cfbc8a88c6e3
Instruction Fuzzy Hash: ACA18CB3F206254BF3584D28CC683726682EB95314F2F827C8E8DAB7C6D97E5D095384

Function 0028E0D1 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939c409fa3c5ebe50217ebb26a3a23e43e8246f6d495dbee94895bff8e798e06
Instruction ID: ff4a9703bf5b33f8461a51643b573146a3bc8aa25791d3347364a1a3eead0463
Opcode Fuzzy Hash: 939c409fa3c5ebe50217ebb26a3a23e43e8246f6d495dbee94895bff8e798e06
Instruction Fuzzy Hash: FCA19CB3F112254BF3444969CC983A17683EB95320F2F8279CE49AB7C5DD7E6D0A9384

Function 00284401 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cbfd9fe46a4522b55a8f6b85221f6b2af0b09d50b2ac9f3c970dec2329938a
Instruction ID: a0f76cab1f11765768261984a30cf0c9e4ac6346210343c7d28ffe83575517b1
Opcode Fuzzy Hash: 57cbfd9fe46a4522b55a8f6b85221f6b2af0b09d50b2ac9f3c970dec2329938a
Instruction Fuzzy Hash: D3A1ADB3F616354BF3044969CC983A1B293A795320F2F4278CE4C6B7C6D97E6D0A9384

Function 0031247B Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50fd72e582c8356f7f214b883a4d9d0696eede31eb3cf8e2de3036574526d06
Instruction ID: ca8f7aa0149dd0e77249977c7669b908341a335d2544e9c07eee87463064203a
Opcode Fuzzy Hash: f50fd72e582c8356f7f214b883a4d9d0696eede31eb3cf8e2de3036574526d06
Instruction Fuzzy Hash: B7A17CF3F512254BF3544929CC643A266839BE5320F2F82788F9D6B7CAD87E5C4A5384

Function 00218275 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e683f447626e4d630b7365a33a65547021d0f83a53948c554e9b37673a32d639
Instruction ID: 071f8b403b9dbfa960b408462ef8c78a31c069d5c61de9dfa461c137e2c9a2b8
Opcode Fuzzy Hash: e683f447626e4d630b7365a33a65547021d0f83a53948c554e9b37673a32d639
Instruction Fuzzy Hash: 63A17AB3F116254BF3444929CC983A1B293EBE5311F2F81788E4DAB7C5E97E6D0992C4

Function 0020311C Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40619cca6702ee0a85485ffc91bb0e8cba8423d338e0d0f691ae1d83499f19be
Instruction ID: 49141b627ca9935664f8ed796c7403d11fc353e148fdd64d363256ee3239b93f
Opcode Fuzzy Hash: 40619cca6702ee0a85485ffc91bb0e8cba8423d338e0d0f691ae1d83499f19be
Instruction Fuzzy Hash: 27A17BF3F112254BF3544D39CD583A26682E7A1324F2F82788E98AB7C5ED7E9C095384

Function 0030C23C Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad0afa709b3810f51866ed2e395d4eb7841d19a28b37b717a600396eaa0e4b7
Instruction ID: 434d142d5af9cc3c2eb81c9527ef54fac922626240694ba64c2f032f996864c2
Opcode Fuzzy Hash: 9ad0afa709b3810f51866ed2e395d4eb7841d19a28b37b717a600396eaa0e4b7
Instruction Fuzzy Hash: 1BA168F7F2152507F3584839CD6836265839BE5325F2F82788F59ABBC9EC7D5C0A0284

Function 001E70A3 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72cbc98004230fd9d59bfae6dc4c21de63364cb21282b56d16f1f61ab195a4e5
Instruction ID: a0de8daa514e6b4859575b02695075c9d31a7bd4cdb3356dbfc81cc931a76bb9
Opcode Fuzzy Hash: 72cbc98004230fd9d59bfae6dc4c21de63364cb21282b56d16f1f61ab195a4e5
Instruction Fuzzy Hash: 6DA139B3F1122647F3484869CD593626683A795325F2F82388F8CAB7C6DD7E9C065388

Function 001E2281 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afba0f521c7933abe0df5a7b5eb42ef066a28b16cb6e421879e7da4aff4434a5
Instruction ID: 6b8a61e31613040e66b3b93656d49fcdb111dc33edccf6ba1bd280a1d79ec098
Opcode Fuzzy Hash: afba0f521c7933abe0df5a7b5eb42ef066a28b16cb6e421879e7da4aff4434a5
Instruction Fuzzy Hash: 89A17AB3F116254BF3544925CCA83A26282EBD5324F2F81788E8D6B7C6D97E5D0A53C4

Function 0020C547 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2002ab7af390c7471a10588d313f86abe1a6a1e6d3cb185f00e2bfc93ae5d642
Instruction ID: d5816ed29fb140f090581c96f2c8cb51d357ea48709c5cb0458ef732e6df0f47
Opcode Fuzzy Hash: 2002ab7af390c7471a10588d313f86abe1a6a1e6d3cb185f00e2bfc93ae5d642
Instruction Fuzzy Hash: 20A19BF3F112254BF3444A69CC983627693ABA5324F2F82788E8C6B7C6D97E5C0953C4

Function 002480D2 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c86a3df28f558170461a2ccf0e99910193456674e05c9700cae255552a4d2a2
Instruction ID: ef33ca07e17b70ab7fc5f9c775a8e00e3be850cee2d483680e2ab1c44b7257ce
Opcode Fuzzy Hash: 9c86a3df28f558170461a2ccf0e99910193456674e05c9700cae255552a4d2a2
Instruction Fuzzy Hash: 1A916BF3F616260BF3584839DD583626583DBE5311F2F82788F49ABBC9D87E9D091284

Function 0027C3A5 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a820ac75d7139e942c57ebc9de8ad5b09f6a3a81e026ff1cb76c00de7f0b904
Instruction ID: 40a08ee03d1b3742316095843622262e6a01552ba48487eb04b2ad3f5a6d7e98
Opcode Fuzzy Hash: 4a820ac75d7139e942c57ebc9de8ad5b09f6a3a81e026ff1cb76c00de7f0b904
Instruction Fuzzy Hash: 6F9158B3F1122547F3544D39CD983626683DBD5324F2F82788E58AB7C9D87E5D0A5288

Function 00236554 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2c9fa18593cc60103734e70cf1264a83940a5eec4abecb9576111807a57255
Instruction ID: 791d526c2176db2c2f95a5a7c5b0ebdaf6615ea4bb5efd49f7f7c45dd5c6e4c4
Opcode Fuzzy Hash: ad2c9fa18593cc60103734e70cf1264a83940a5eec4abecb9576111807a57255
Instruction Fuzzy Hash: 449179B3F616254BF3484839CC683726683DBD5321F2F82788B596BBC9DC7E5D0A5284

Function 002B61EF Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d065db51dc34cb388f3abdd023c384f7c54d89c26d68cbd1c14f7016e42567e7
Instruction ID: b8ec3f3273da32298534c6e28490a45ffe04c26cd49ee9b0748ead2b405bce5f
Opcode Fuzzy Hash: d065db51dc34cb388f3abdd023c384f7c54d89c26d68cbd1c14f7016e42567e7
Instruction Fuzzy Hash: 7F9164B3F1122547F3544969CC583A26253A7D5325F2F82788F5C2BBC9D97E5D0A43C4

Function 0027A579 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf634e5f30084f47c1569f43407dda8d0ca4eed426107fd164bc28e4265be165
Instruction ID: 2efb3417bf8c92ddb6b4be64b12744ac5f66eeb7b8382cef8deb79144836e05b
Opcode Fuzzy Hash: bf634e5f30084f47c1569f43407dda8d0ca4eed426107fd164bc28e4265be165
Instruction Fuzzy Hash: B19182B3F216254BF3504929CC583A27683EBD5321F3F81788A8C6B7C6D97E9D465384

Function 00278035 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e8c3f84c94b6138f8e8a2aae8ea8299001e9d4ac3a68ec5f62c8eb9d70940a
Instruction ID: d4832c21160a6d1d98747a257cf05649edbcf1f12e69c7cd948521efa82d4ad0
Opcode Fuzzy Hash: 51e8c3f84c94b6138f8e8a2aae8ea8299001e9d4ac3a68ec5f62c8eb9d70940a
Instruction Fuzzy Hash: 1C917CB3F101258BF3544E69DC943B27283EB95320F2F81788E896B3C5D97E6C4A9384

Function 002B21F0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdda60e3c12935c50fd18ba40846b3fe16e4f9da140dfec205424c88cd10e62
Instruction ID: 5bbacb7cf10685ffa079506eb11b4243bf0bf62cf5d4158e5ac97ea4dfe2ce79
Opcode Fuzzy Hash: bbdda60e3c12935c50fd18ba40846b3fe16e4f9da140dfec205424c88cd10e62
Instruction Fuzzy Hash: 70915BB3F116254BF3544D29CC483A17293E795321F2F82788E8CAB7C5D97E9D0A5388

Function 00228230 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577087e97394d45f332e59e4de618b67c8c478cc379161833e5de3400820a392
Instruction ID: 25ff361101e5a81d0cf618641544ef0fc96674260e22049e9a6be171687ba370
Opcode Fuzzy Hash: 577087e97394d45f332e59e4de618b67c8c478cc379161833e5de3400820a392
Instruction Fuzzy Hash: CD917DB3F102254BF3544D69CD983A27683DBD5310F2F42788E9CAB7C9D97E9D0A5284

Function 00312069 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181b6a8e5af64ada4ca012ad962276f5ab8df0fcec30693e9a3295d73967a5ee
Instruction ID: c214ab09b99cbcfe6db31835102ab8514cbc0fb62522615ce3a54b6f1454d85f
Opcode Fuzzy Hash: 181b6a8e5af64ada4ca012ad962276f5ab8df0fcec30693e9a3295d73967a5ee
Instruction Fuzzy Hash: 3191A1B3F112254BF3444E69CCA43A17693DB95320F2F8178CE88AB7C5D97E6D4A5384

Function 00234255 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5062059c7b8dd210048c83f268db56a35a5f8b16d3b08f8ae77e5a4b9cd23c1f
Instruction ID: fcee1eec2d2d1d244d6b1e1ceb1cce01a35c0534a4db5f7f29905768be490817
Opcode Fuzzy Hash: 5062059c7b8dd210048c83f268db56a35a5f8b16d3b08f8ae77e5a4b9cd23c1f
Instruction Fuzzy Hash: DF916CB3F2022547F3544D68CD683B26642D791324F2F82788E9DAB7C6D87E9D0953C4

Function 0020E0C7 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860df7bfc59abf87453a81c235da1daf84bddfa56b23f48e139d80b70e583f53
Instruction ID: 8866068768d2d477bc4a46ac94c41149168079e9dc1c72f3d0a8ec12e9eef4f2
Opcode Fuzzy Hash: 860df7bfc59abf87453a81c235da1daf84bddfa56b23f48e139d80b70e583f53
Instruction Fuzzy Hash: 87918BB3F112254BF3540E29CC983617693EB96324F2F82B88E8C6B7C5D97E5D4A5384

Function 0029E01A Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579dc621537640d23053ba18bf51da4b7b2b810d2a85004d3528946bce318d8b
Instruction ID: 355e5c89675c5bfba6a98d89d8f2b9ec4502dcc98b9dbcf75e88f0e1aabfba60
Opcode Fuzzy Hash: 579dc621537640d23053ba18bf51da4b7b2b810d2a85004d3528946bce318d8b
Instruction Fuzzy Hash: 1E916DB3F102258BF7544E64DCA43A27692EB95314F2F82788F892B3C5D97E6C0997C4

Function 003030B3 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa5e24b8f10ab1ac327f965f3b81f4b05672645217933b7965868853b4a887f
Instruction ID: 03a3cbe4b874229acaa4e93dc7736cdfe9623dc2fa58605b187d9f30bf276903
Opcode Fuzzy Hash: 8aa5e24b8f10ab1ac327f965f3b81f4b05672645217933b7965868853b4a887f
Instruction Fuzzy Hash: EE919DB7F112254BF3444E29DCA83627293EB95320F2F82798E896B7C4DD7E5D0A5384

Function 002E4432 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4021661623876fd5b1fe788065249786883fda76fc8d31c67fe02d152e1476
Instruction ID: be536fd9b5fc2340045ff28c4b3fdf37b1ebcd68a7722298124791f25987eb72
Opcode Fuzzy Hash: 7e4021661623876fd5b1fe788065249786883fda76fc8d31c67fe02d152e1476
Instruction Fuzzy Hash: FF9157E3F116254BF3484969CDA83622583EBD1314F2F81788F89AB7C5DC7E5D0A5288

Function 0023E5A3 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ae2f82cee02cf4f0cd82c50d3eb8aef2bcf1a0a93babbde3279211c7a82fae
Instruction ID: eca5594526e8289e7730dda8877a404b7f29b9ca6cfce3ce8fb715f8f3708365
Opcode Fuzzy Hash: 30ae2f82cee02cf4f0cd82c50d3eb8aef2bcf1a0a93babbde3279211c7a82fae
Instruction Fuzzy Hash: 73915CF3F6162547F3644C39CD58362A6839BE5310F2F86788E8CAB7C5D97E9C0A5284

Function 0025507A Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba9e60409df04db2ee2209408b231c7cba1aadebcdb2f40d87ed14a1ebdbf2e
Instruction ID: 53f04d82a69319baa0a5d81398f8a4605b7b1ad30f25174baf6fdd606d871bc2
Opcode Fuzzy Hash: 7ba9e60409df04db2ee2209408b231c7cba1aadebcdb2f40d87ed14a1ebdbf2e
Instruction Fuzzy Hash: 52916BF3F116244BF3544D29DC983A262839BD5325F2F82788E9C6B7C5D87E9D0A5388

Function 002B8168 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1686025e2e946af81ccdbf86acfeefe8975e0a7fa61fc7d64ca18e43646e0da
Instruction ID: aa517a8468ccdfc352ea8c0cddfd2cc7767306443d8367285921d5d50c6ccd55
Opcode Fuzzy Hash: e1686025e2e946af81ccdbf86acfeefe8975e0a7fa61fc7d64ca18e43646e0da
Instruction Fuzzy Hash: 289159B7F112254BF3544D29CC983627683ABD5324F3F82388A98AB3C5ED7E6D165384

Function 002D821E Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed04fef3d915074248e8428c05c54ca6d45b52d312364ca42f856c3f9bf358b5
Instruction ID: 8e86939b5fa0fe656e7865046d55d3ca8b52c52c0a58405b9496ccfbe5f3e540
Opcode Fuzzy Hash: ed04fef3d915074248e8428c05c54ca6d45b52d312364ca42f856c3f9bf358b5
Instruction Fuzzy Hash: 3D917AB3F212254BF3544D29CC683A27653ABD6320F2F8278CA986B7C5DD7E5D0A5384

Function 002BC41C Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180a9924eceebf1bd012671ef24d680607cf2e00c44ac571387695e495f2a894
Instruction ID: 3fb23c204c0c0febc8e3fc7ba97278aa5c47e19818c3a921d462b7c82dc75b03
Opcode Fuzzy Hash: 180a9924eceebf1bd012671ef24d680607cf2e00c44ac571387695e495f2a894
Instruction Fuzzy Hash: 36918DB3F111258BF3544E68CC543A1B392AB96320F2F4278CE986B7D1D93E6D1993C4

Function 001EC09F Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a3cf6766fd58bbafc6bfaabeeeb37daca49aee61a710caed2821b34c715bed
Instruction ID: d1464fbafe910426c432fb2af8bdf2acfdde469677dbb72371285225e71d504d
Opcode Fuzzy Hash: 50a3cf6766fd58bbafc6bfaabeeeb37daca49aee61a710caed2821b34c715bed
Instruction Fuzzy Hash: E0917AF3F116254BF3540968CC983A2B652EBA5311F2F81788F886B7C6D97EAC0953C4

Function 00293183 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63903365f098185f46b7c8563c86b2b98b19513ef49077d93344d89f33f44cb
Instruction ID: c0e77944cf2bdebda21c03053147fd22eb24741e92dfb42a9d772f73cfc19776
Opcode Fuzzy Hash: a63903365f098185f46b7c8563c86b2b98b19513ef49077d93344d89f33f44cb
Instruction Fuzzy Hash: 858188B3F111254BF3444E69DC983727293EB95310F2F82788E886B3C5D97E6D4A9388

Function 002381C8 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f015fd643ee2e49d9bf074bbae4ca40a5de5220db3360be6988098032eb51821
Instruction ID: 0c453db895bbcc807a8ea52726e44d176743de64d064909dbf72f450b6013043
Opcode Fuzzy Hash: f015fd643ee2e49d9bf074bbae4ca40a5de5220db3360be6988098032eb51821
Instruction Fuzzy Hash: A4917AB3F112254BF3944929CC583A26243EBD5325F2F82788E886BBC9D97E5D0A53C4

Function 002C8214 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb09a8a3331085b56a7dd7691fcdf1cbff00ad871ee798144fd26851f2d55242
Instruction ID: 8a8cde79ceeb048c0f829659f9e4837770f77ba748b1b56fcded57cb0de39881
Opcode Fuzzy Hash: cb09a8a3331085b56a7dd7691fcdf1cbff00ad871ee798144fd26851f2d55242
Instruction Fuzzy Hash: 99815BB3F102254BF3484929CC983727293DBD5321F2F82788A595B7C5DD7EAD0A9388

Function 00262259 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394a19a3d16a0debcc0f2e77a3dfed6130b5fdbad6ed0d93517c3f8f96bdfde5
Instruction ID: c4967eb331067b8677d66cc34c3250f1a222dfe590fc679490c7caef7941fca3
Opcode Fuzzy Hash: 394a19a3d16a0debcc0f2e77a3dfed6130b5fdbad6ed0d93517c3f8f96bdfde5
Instruction Fuzzy Hash: 1E819BB3F116254BF344497ACD983A225839BD5320F2F82788F596B7CADDBE5C0A5384

Function 002561BA Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633f0f2ef2b2c8f491e5b20cc8a276a0f2019eceffa2f1c765860871c2364a86
Instruction ID: fbfba4c51475cc7ff47f1bc5d6305ed4fb0d99f29c358703c7605fd950c378eb
Opcode Fuzzy Hash: 633f0f2ef2b2c8f491e5b20cc8a276a0f2019eceffa2f1c765860871c2364a86
Instruction Fuzzy Hash: 1D81C2B3F616164BF3444D78DC883A22683DBD5311F2F82389E589B7C6E97E9D095388

Function 002E0509 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bad29c97ff6883db03cf24f5956a702d5cfe9a65b6ed3ef713194d90307edf
Instruction ID: b18da7b5ce72c2e76a939babb0a07e92e01e8fb9ccfd7fff8632af481827ca08
Opcode Fuzzy Hash: 19bad29c97ff6883db03cf24f5956a702d5cfe9a65b6ed3ef713194d90307edf
Instruction Fuzzy Hash: DD8190B3F112254BF3504E69DC843A27293EB95320F2F82788E986B7C5D97E6C495784

Function 003001F1 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca2e8047cded61a93a3cd1ee596891561d9da1572674c3fb6f0a6ba47835f6e
Instruction ID: 7f24964bfb1aa6acfd4387bd8d7351a011a631dbd3bb04b19895e2c86463a646
Opcode Fuzzy Hash: bca2e8047cded61a93a3cd1ee596891561d9da1572674c3fb6f0a6ba47835f6e
Instruction Fuzzy Hash: 58815AF3F216254BF3484929CC683617293DBD5315F2F81B88B496BBC9D93E5D0A9388

Function 001F1162 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b2dfadee83275cbd7d6529fe39669ab27bce4a98e0cc96d101dc1b1ce02bf4
Instruction ID: 61249ad5142d77aa331e77ec241029113654ade1418d95c87d051397e391de93
Opcode Fuzzy Hash: a1b2dfadee83275cbd7d6529fe39669ab27bce4a98e0cc96d101dc1b1ce02bf4
Instruction Fuzzy Hash: A0818BF3F5162547F3044868CC983A165839BD5325F2F82388F9CAB7C6D87E9D0A5288

Function 0024C51B Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17162f256fc23a695fabd574995f02418121863c833998acb3518ae98dd6f5a
Instruction ID: d383359a8dc00489a93506f4190bf63131d1e1c2863f0f62237b34b5e5c19118
Opcode Fuzzy Hash: f17162f256fc23a695fabd574995f02418121863c833998acb3518ae98dd6f5a
Instruction Fuzzy Hash: FB818EB3F212124BF7544939CD983626683EBD1310F3F82388A589BBC9DD7E9D4A5384

Function 002F909E Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95801c65b22ad96e7093784e24cfb652db73b24b3a32bddeae16d369645b1225
Instruction ID: c344dda98e6017c196bacea57afd55c8eafb32701e905c0ce0f180709d8cadac
Opcode Fuzzy Hash: 95801c65b22ad96e7093784e24cfb652db73b24b3a32bddeae16d369645b1225
Instruction Fuzzy Hash: 8C8169B3F116254BF3544929DC443A2B6939BE5321F2F82788E8CABBC9D97E5C0653C4

Function 002923F1 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744692fc8de984c1c1d69e4812f65e4cf38bad3820315f7e3548455f0afcd292
Instruction ID: 39fbf0e468a143540075ec73c4ef13ce4d7c17ab1b067262e27e448ee253b54a
Opcode Fuzzy Hash: 744692fc8de984c1c1d69e4812f65e4cf38bad3820315f7e3548455f0afcd292
Instruction Fuzzy Hash: 0D8168B3F112258BF7584969CC983627683EBD5310F2F82388F886B7C9D97E5D0A5384

Function 0028A1B2 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b120fd0c404595c84856b28039e6cc7e48eba4ac634afd107a5a10c101239282
Instruction ID: fd22bd7a354697eee71f8a3e064992f6b79104e03c69ac9f2a16fa7b63b1deb5
Opcode Fuzzy Hash: b120fd0c404595c84856b28039e6cc7e48eba4ac634afd107a5a10c101239282
Instruction Fuzzy Hash: 48818DB3F112254BF3644E68CC983B1B292DB95310F2F817D8E886B7C5E97E6D099384

Function 0024A28B Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb6dac69f95bde4ecfd7fa18cabc28b3789e1d6bff0f67ef67328351878d102
Instruction ID: 2531931106b4ea39e286cf9f62debc2d979bace95d8e003aecf577122083a652
Opcode Fuzzy Hash: ccb6dac69f95bde4ecfd7fa18cabc28b3789e1d6bff0f67ef67328351878d102
Instruction Fuzzy Hash: BE816EB3F112254BF3544D69CC98362A693EBE5310F2F82788E88AB7C5D97E5C4A5384

Function 00296045 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05d5dd00a255903d03ad2620c0a3bceb26723132a30117b454119f2f88d5d39
Instruction ID: 23ed1e61e7a12f76588792c0bd034f446f9ecc03ee54a8a48b52b3f7468dbda8
Opcode Fuzzy Hash: d05d5dd00a255903d03ad2620c0a3bceb26723132a30117b454119f2f88d5d39
Instruction Fuzzy Hash: 408190B3F212254BF3444D29CC583A27693EBD5324F2F82788E58AB7C5D97E9D099384

Function 0025011E Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1371801b83100a32f7ffe29b5021fa905358b8f2f069b7de5486aca1ad5fd152
Instruction ID: 04c8cc83e1d3bd8d2c22312516af1e72b68b5b526b637867509dfb406f164ee7
Opcode Fuzzy Hash: 1371801b83100a32f7ffe29b5021fa905358b8f2f069b7de5486aca1ad5fd152
Instruction Fuzzy Hash: 31816AB3F116254BF3544969DC983626282EB91325F2F82788F9CAB7C2D97F5C0A53C4

Function 0021A340 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804a8fe7e7bf50d07505f0cba629ed9dd996822d483fbe666f1786423a6eb0d1
Instruction ID: 2dbc143c2c92675659cf3b983fa23971e3c851594d581698b5cd3a979fe34f45
Opcode Fuzzy Hash: 804a8fe7e7bf50d07505f0cba629ed9dd996822d483fbe666f1786423a6eb0d1
Instruction Fuzzy Hash: 52819EB3F1162547F3444979DC583A22283DBD5324F2F82788A9CABBC9E97E5C0A5384

Function 0021C429 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5f3181dd1a0613a0b4d587811704b89817dd42b9a8f4d47aaae90016a02656
Instruction ID: 898f4109017894df46b9b27390d9d994e05801dae85fad6bc162dd8eb7c5f127
Opcode Fuzzy Hash: 5a5f3181dd1a0613a0b4d587811704b89817dd42b9a8f4d47aaae90016a02656
Instruction Fuzzy Hash: 2F8159F7F516210BF3444979DC983A26683D7E1325F2F82388F586BBCAD97E5D0A4284

Function 002F0285 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5151dfece10551aa476bb6996557b76a67eb0827f1ba245d321ecbee1bb301c8
Instruction ID: 9b4dbce56ecf23e8a94f93dac6c0601c72326a878aa8bfdeba001cec1bb59961
Opcode Fuzzy Hash: 5151dfece10551aa476bb6996557b76a67eb0827f1ba245d321ecbee1bb301c8
Instruction Fuzzy Hash: 66816BB3F216254BF3444D69DC983627293EBD5324F3F82388A489B7C5D97E9D0A5384

Function 0021024E Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d84d7579327ed3f388e970f9c7809c441b2125648474b36ca7c55ebc1523d16
Instruction ID: a256251d0358a9d410a1481de989a7ae1cef8f630fc0e56a4d53eb39e60f5471
Opcode Fuzzy Hash: 7d84d7579327ed3f388e970f9c7809c441b2125648474b36ca7c55ebc1523d16
Instruction Fuzzy Hash: AC815AB3F112254BF3544D29CC983627653EBD5314F2F81788E886B7C9D97E5C4A9384

Function 00212141 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ad587bbfbf520f0ebed681ce4486893b3f7ebb5975f3d66294c46136d39b77
Instruction ID: 3e57b96247a4d3c64acff95b15ac3c6d89a85753f920324475f1c768b9317f41
Opcode Fuzzy Hash: 64ad587bbfbf520f0ebed681ce4486893b3f7ebb5975f3d66294c46136d39b77
Instruction Fuzzy Hash: F08158B7F115258BF3540E69CC583A27693ABD5311F2F82788E886BBC4D93E5D0A53C4

Function 0025C29C Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e76e7dedc4a19fb6f0d82d9b46bdc799609c799c5a2bffbbc02562b33d3d73
Instruction ID: abc371b0729bf6c353433bb190a58553f5d3485b875e9845a7281bd19f7f00f0
Opcode Fuzzy Hash: c2e76e7dedc4a19fb6f0d82d9b46bdc799609c799c5a2bffbbc02562b33d3d73
Instruction Fuzzy Hash: 60819EF3F502254BF3544D69CC983627682DB95324F2F82788F886B7C9D97E5D0A5388

Function 001F81DB Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a23a3c3a25f5b4b0aebc5d44ee689b4d61a0cc8367158a62402eb30a00df619
Instruction ID: 7fe54f8292529abf67962126b70d13fa5f78946318537eec2462f3fc75444ff5
Opcode Fuzzy Hash: 3a23a3c3a25f5b4b0aebc5d44ee689b4d61a0cc8367158a62402eb30a00df619
Instruction Fuzzy Hash: 138168B3F112254BF3544D38CD983A27693EBD5310F2F82388A486BBC9D93E5D0A9784

Function 0027F0D0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6ae5b23c24ee40870a19590dad62b96b2daf5fb19a69282f513a06d3d144b0
Instruction ID: b768e6f91e56a964be21b65fb2c8eb1e50552fbfaff8d2120e9020883bf5f24f
Opcode Fuzzy Hash: 6e6ae5b23c24ee40870a19590dad62b96b2daf5fb19a69282f513a06d3d144b0
Instruction Fuzzy Hash: 4D719CB3F112254BF3544D69DC68362B283EBD5320F2F82798E98AB7C5D97E5C0A5384

Function 002EE155 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cbe1e06ba4a6c7367b29a47c594f3b55c2c755ea06cca0e325296c4674005b0
Instruction ID: a83091a4073ca59363d07b31f2925ce99071e429be01a9bb39d4e76fbd65fd56
Opcode Fuzzy Hash: 4cbe1e06ba4a6c7367b29a47c594f3b55c2c755ea06cca0e325296c4674005b0
Instruction Fuzzy Hash: 36819EB3F112258BF3504D79CCA83627692EB95311F2F82788E886B7C9D93E5D0993C4

Function 002F4401 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae7fa650b5313b25546bc8cb4983881b9b4f965d867a2d93e9d7513b6470cbc
Instruction ID: 6730e0072bb90b06a3133dd14ed576dc0e64500cebb2ecca042de59598907055
Opcode Fuzzy Hash: 1ae7fa650b5313b25546bc8cb4983881b9b4f965d867a2d93e9d7513b6470cbc
Instruction Fuzzy Hash: B8718CF7F106244BF3144D29CC9836266939BA9321F2F42788F8C6B7C5E97E5D0A5288

Function 002BD070 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938ac82928cf64fcd830a7383f237a08a53ee57885d1754bc1bd3b422eb44440
Instruction ID: 4bf69baf4590060b41311cbeab188d818e41dc676ceb6495a915acc7d8795edc
Opcode Fuzzy Hash: 938ac82928cf64fcd830a7383f237a08a53ee57885d1754bc1bd3b422eb44440
Instruction Fuzzy Hash: C7715BB3F1122647F3140D29DC68361A693DBD1324F3F82788A586BBC9D97E9D1A5384

Function 001EF07C Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9cd3f2daf204bc00489a2a5753331e9896fd1a52cba74ca8c66b3ee8d16f1a
Instruction ID: 291a1af341b30192ed225225060414e67b928b844aef1fab5c4604aecfc9059a
Opcode Fuzzy Hash: 3d9cd3f2daf204bc00489a2a5753331e9896fd1a52cba74ca8c66b3ee8d16f1a
Instruction Fuzzy Hash: 13717D73F011158BF3144E69CC543B17693EBC6310F2F81B88A989B7D4DA7E6D05A784

Function 002521D4 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2577650aa7b50039b4033ec69e34495327af46e5cb04cb9b395c4957ada0f6
Instruction ID: 8d113ec4da03fac081889747695b1d30dfda1f0d5e673b340a33954a0562e3a2
Opcode Fuzzy Hash: 5d2577650aa7b50039b4033ec69e34495327af46e5cb04cb9b395c4957ada0f6
Instruction Fuzzy Hash: 71714CF7F126254BF3404929DC583627283DBE5321F2F81788A986B7C6DD3E5D0A5384

Function 003090A5 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6753b473faa1559600df6776467a727e6acc772c7beaaf66fbb39c54ac17689
Instruction ID: ef8eefafd78f690aa0307e67ec843709923adc0320e682b39d50b8d0b5aebadc
Opcode Fuzzy Hash: b6753b473faa1559600df6776467a727e6acc772c7beaaf66fbb39c54ac17689
Instruction Fuzzy Hash: 06717BB3F116254BF3540D69CC583627693DBD1324F2F82388E48AB7C9D97EAD0A9384

Function 0025438C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0f7bbe585ee828356056b02c68cd79f38869510115bac13067f39e8c9c58bc
Instruction ID: e36d53ad6a779e98a15b95ebf79d78e190398db59fb5a4ecf83027e4846652be
Opcode Fuzzy Hash: df0f7bbe585ee828356056b02c68cd79f38869510115bac13067f39e8c9c58bc
Instruction Fuzzy Hash: EE717AB3F1122547F39449A8CC583A2A253ABD1325F2F82788E9C6B7C5DD3E5D0A53C8

Function 0022618B Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25d3fc53f5f1d88cd4b982e8026610e61a74f58251df37fe2e8b72bb5b800a2
Instruction ID: 0ef6b261f5d8d19e370aa5fae7197b41212aa7378d8832d8dbf0a1169b48b2a3
Opcode Fuzzy Hash: d25d3fc53f5f1d88cd4b982e8026610e61a74f58251df37fe2e8b72bb5b800a2
Instruction Fuzzy Hash: 50715FB3F5112547F3584D39CC693726683EB85310F2E827D8A89AB7C8DD7E9D0A5384

Function 0028847F Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef3c48a59594e253b9be786665ff4de357b62d5e81e686b5ffbd16788240c61
Instruction ID: 1b32b6edc968384e4077ab0913a7cc98ecccb536db1ea56269d53420a0d59641
Opcode Fuzzy Hash: 4ef3c48a59594e253b9be786665ff4de357b62d5e81e686b5ffbd16788240c61
Instruction Fuzzy Hash: 2D7169E3F1162147F3444979CC983626283DBD5325F2F86788F98AB7C9DC7E9D0A5288

Function 00314233 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3635475a36e6430bda3230e2f5b70453e78c9df6a6714aad650e00155fecff9
Instruction ID: b9980df4d73a50744ed8ad7f0292d72ef84009f07cde39d10291b7ee0fa649f8
Opcode Fuzzy Hash: a3635475a36e6430bda3230e2f5b70453e78c9df6a6714aad650e00155fecff9
Instruction Fuzzy Hash: 327169F3F212254BF3484878CD68366668397D5324F2F82788F596B7C9DC7E5D0A5288

Function 00282282 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeea114dbc4e2d2762cb44ef16d047db98bb01ee2aebd9718c3286e7e76c1bac
Instruction ID: 0ad84bdd43cd5eea3d0fff29addb89c7a853af88afc7cfd514015c8d30b19bd3
Opcode Fuzzy Hash: eeea114dbc4e2d2762cb44ef16d047db98bb01ee2aebd9718c3286e7e76c1bac
Instruction Fuzzy Hash: 08718AB3F112254BF3544D29DC983627283EBD5711F2F82788E496B7C9D97E1C0A5384

Function 002FC38F Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4722259472a015b510af78d1deaddccfa260f8537e47c61fd40388f6d57b6d
Instruction ID: 43469f15e185cb637752aff5153e67b5b878d0f4e3c523171b10e60f4b07c6b7
Opcode Fuzzy Hash: eb4722259472a015b510af78d1deaddccfa260f8537e47c61fd40388f6d57b6d
Instruction Fuzzy Hash: A1719DB3F116158BF3044969CCA8362B283DBD5321F2F82788E595B7C5DD7E9C0A5384

Function 0019E290 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974773d762c955713e5e13241fda9392e08229cdcda0ddc9df5a14fb74c0fc9b
Instruction ID: a7d0476a1662818bf59bffa0010338a513a947a72a429a42716bace4262dc771
Opcode Fuzzy Hash: 974773d762c955713e5e13241fda9392e08229cdcda0ddc9df5a14fb74c0fc9b
Instruction Fuzzy Hash: 936127367496C04BEB2CC93C8C2126ABED35BD6234F2EC76DE5F6873E2D66588058351

Function 002F6162 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a86099428b7363148d425377544fc4f2e0a2a8a7978a48e137f8b196f9418f
Instruction ID: bdf4b7b846e234e429a907e3d29ad53aaab47ff22d824d74719f85e07d7cd854
Opcode Fuzzy Hash: 39a86099428b7363148d425377544fc4f2e0a2a8a7978a48e137f8b196f9418f
Instruction Fuzzy Hash: 4671ADB7F112254BF3444D68CC983A17693EBD6311F2F81788E486B7C5D97E6D0A9388

Function 002301E4 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c35e86bde164c84bbf2605e9a7e95a8e15e2d3dd6d93c778878c11d5c16644
Instruction ID: 2caba4360364b03a863762a893113831ded2bd430767de542c3e86f34f529d3b
Opcode Fuzzy Hash: f0c35e86bde164c84bbf2605e9a7e95a8e15e2d3dd6d93c778878c11d5c16644
Instruction Fuzzy Hash: BC717AF3F5121647F3944D65CC983A26643EBD1324F2F81388B495B7C5E97E9D0A5388

Function 001E0265 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9abd6fd08db33c088417ff153f70137a9a3a4b6d41473c84627c5e769c0702a
Instruction ID: 7ba80db452dfcd17294a7618354502909972e544b7df15358b23b7cbe9653a03
Opcode Fuzzy Hash: f9abd6fd08db33c088417ff153f70137a9a3a4b6d41473c84627c5e769c0702a
Instruction Fuzzy Hash: AA715CB7F116254BF3944D29DD983627293EBD5320F2F81788A8C5B3C5D97EAC0A5388

Function 002E01AC Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867a7b3fa99628657c724ae008d1c94cc958c373800bf6678bee17b933582b8b
Instruction ID: cabd0d479f234899daf781e362b3ffa1b5db941a3cabe2250a798131f25b1899
Opcode Fuzzy Hash: 867a7b3fa99628657c724ae008d1c94cc958c373800bf6678bee17b933582b8b
Instruction Fuzzy Hash: C2719AF3F516154BF3484A69CCA83B27243EB95310F2F81388B495B7D5D97E9D0A6384

Function 0024439E Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e72b9a6b4ba12f79ea7bb4cfc545b56e79e6ce90cba630cf6d759ddbb973fb
Instruction ID: f9f8bb78566c1f2c81252f74d60835cda1ffdb6982692658351a36a73f4da25e
Opcode Fuzzy Hash: d6e72b9a6b4ba12f79ea7bb4cfc545b56e79e6ce90cba630cf6d759ddbb973fb
Instruction Fuzzy Hash: 9971ACB3F112254BF3444A79CC583727683EB95320F2F82788E989B7C5D97EAD095388

Function 00263000 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892f575afc28942cdfef61f7219c27c70eb2b398a32fa6f7350a7ea4d73b7fea
Instruction ID: 8d6f5d8da90e50774022366e27ea9822320b2a72606e9614111c23746fa37772
Opcode Fuzzy Hash: 892f575afc28942cdfef61f7219c27c70eb2b398a32fa6f7350a7ea4d73b7fea
Instruction Fuzzy Hash: 936144B3F106254BF7584928CC683A66683EBD5314F2F817C8F8A6B7C9C97E1D095384

Function 002504FF Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9721adfff90d602763ec1213fc468d15fdf13e56346f77ba48a16a22ce8a17b
Instruction ID: 8f1d8e7b1c26e8701fd091b3c02e4c6c4a66afe0892a2d92b23ec31119633091
Opcode Fuzzy Hash: a9721adfff90d602763ec1213fc468d15fdf13e56346f77ba48a16a22ce8a17b
Instruction Fuzzy Hash: 4371ABF3F116264BF3180D28CC983717692DBA6321F2F427C8E596B7C5D97E5D095288

Function 002B71BB Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8802ddc339c1dfddf2b295da9744ad7660c2eb9fec79edaae762b05178972cfe
Instruction ID: 631032fd29dd2027abf75a4da6f1944ff4d82303de3a7e405bfe725ae12de48f
Opcode Fuzzy Hash: 8802ddc339c1dfddf2b295da9744ad7660c2eb9fec79edaae762b05178972cfe
Instruction Fuzzy Hash: B861BAB3F521258BF31409A4CC943A2B683ABD1321F3F82B88F982B7C5D97E5C565384

Function 002F8477 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9dc4d2f3f12e4bf0bd6f902c7f4d0dde7fa8395c20c083328f401ec2955b1a
Instruction ID: 7f44b332b8cbb2840ea248603b1200c48dd1e66acd5d979128fa77385e8056e2
Opcode Fuzzy Hash: 2b9dc4d2f3f12e4bf0bd6f902c7f4d0dde7fa8395c20c083328f401ec2955b1a
Instruction Fuzzy Hash: FF615CB3F111258BF3544D29CC54361B692EB95320F3F42788A98AB7C0D97EAD0A5784

Function 001F855B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c1683d7995c328c565c4653e68f995e3a30f2b684098e6b3f8c199be168e8a
Instruction ID: 4071b2f079c193bb8db6886884bfcceaae48709aa45ae9395e48d356a35cd896
Opcode Fuzzy Hash: 40c1683d7995c328c565c4653e68f995e3a30f2b684098e6b3f8c199be168e8a
Instruction Fuzzy Hash: B4618AF3F21A2547F3580879DC583A2668397E5328F2F82788E5D6B7C6DC7E5C064288

Function 002FC06E Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737597f9e94af5db75ce404a9a6a9f17b157a1ac5668d6b69193c8b469188783
Instruction ID: 25179e4101acadef3840f4368f3f51a4897fd0e8c66ad0e35342f167911ce17b
Opcode Fuzzy Hash: 737597f9e94af5db75ce404a9a6a9f17b157a1ac5668d6b69193c8b469188783
Instruction Fuzzy Hash: AD616BB3F102254BF3544D39CD683617692EB95324F2F82788E89AB7C9D97E5C0A5384

Function 002AC15B Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a59b030a470f9048be8af406fa0a19aeb8f9e74e5594008c1bc2b7ee1a7441d
Instruction ID: d856dc4762954b28b57910b56fde0aa1b3e2d0b778a9229c612ebe57b5d3dfbd
Opcode Fuzzy Hash: 2a59b030a470f9048be8af406fa0a19aeb8f9e74e5594008c1bc2b7ee1a7441d
Instruction Fuzzy Hash: EA618DB3F216214BF3544979CC983A16683DBD5324F3F82788EACAB7C5D97E5C0A5284

Function 002F4129 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a638c15edbba81eb53f10746fd9046e9cecb08b8a3bfeb936dea4414311b5bb
Instruction ID: ca85ca5d2a6aec60951fa538bb6b28af726be153bd88a17305c94426a1777c2e
Opcode Fuzzy Hash: 7a638c15edbba81eb53f10746fd9046e9cecb08b8a3bfeb936dea4414311b5bb
Instruction Fuzzy Hash: E451A3B3F216254BF3844D69CC983A27293EBD5311F2F81788E885B7C5D97E6D0A5388

Function 002A6323 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15a6cc114177a9b2c5858a84590937446cbd3c989da11eb798eed6792888915
Instruction ID: d7d8bed7e92ae9bcf96c887b3082265a49e18c133fe1e202d6ac9e9f21db6ea7
Opcode Fuzzy Hash: f15a6cc114177a9b2c5858a84590937446cbd3c989da11eb798eed6792888915
Instruction Fuzzy Hash: 9E517BB7F1262647F3544929CC583727293DB95324F3F81788E486B7C6DA7E9E0A4388

Function 002A25B5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0dee0c9138f1d2ebcb060c2c9d2caa7ce649449e977b817b092f12d1f8a7448
Instruction ID: 99435992a877c51534671bd4c8428c5d85d283ca40222e3c05945b6447699686
Opcode Fuzzy Hash: a0dee0c9138f1d2ebcb060c2c9d2caa7ce649449e977b817b092f12d1f8a7448
Instruction Fuzzy Hash: 0A5149B3F102258BF3648D68CC983A17292DB95320F2F42788E8C6B3C5D97E5D459388

Function 001F4166 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54944555d9a8811022b14f5bc6c4d670d1a7c8575b05c05e260d52da8933e25
Instruction ID: b55abdfa3ab46ad149cc4f6c0335a390df62f6d1fd72792ad5f2f18031feb644
Opcode Fuzzy Hash: f54944555d9a8811022b14f5bc6c4d670d1a7c8575b05c05e260d52da8933e25
Instruction Fuzzy Hash: 6551E273F216254BF3444E69CC983B23293EB96311F1E817C8E989B3D5D97E6D0A9384

Function 0024F0AA Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9274a7892824d567402f612f28794062727eaa31856c867fea5fcb6dce4189
Instruction ID: e84937746bab5defe9c1b74b2fe4b7c93f45388c64a9f28ac125e4bf37e91f39
Opcode Fuzzy Hash: bd9274a7892824d567402f612f28794062727eaa31856c867fea5fcb6dce4189
Instruction Fuzzy Hash: 1C5168B3F1122547F3980D28CD683656683E790324F2F867C8E8AAB7C5D97E5D0A4384

Function 002E9020 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608785cdef3756444d8f667e51f4aafe01d48ec3cd6bb5b1ee96128ea8ba55ec
Instruction ID: f96255faa2a8ec53c44dbd24e7d5b02d7d6ac9f47b7b86ba79698542635c20ca
Opcode Fuzzy Hash: 608785cdef3756444d8f667e51f4aafe01d48ec3cd6bb5b1ee96128ea8ba55ec
Instruction Fuzzy Hash: 1C519EB3F6062547F3944964DC993A22283E7D5320F2F81388F999B3C6DD7E9C4A5384

Function 002CA15D Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4e9b5ef1252324823dce89c75ad3e7f8e7b9f2c2091da9f028ab15b9f50416
Instruction ID: 156a05e0c9bf441ab6ea54e2431530a9cbd37d7431fe51c2f5d16e630cd1d88d
Opcode Fuzzy Hash: cc4e9b5ef1252324823dce89c75ad3e7f8e7b9f2c2091da9f028ab15b9f50416
Instruction Fuzzy Hash: 3E517DF7F2262547F3540928CD983A13253DB95325F2F82788F68AB7C5D93E9D095388

Function 00287015 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245cc1854b0a76b1e9c9794d54a8988a620f117b88c4776061baa9680a608b5f
Instruction ID: 6ea9e0ccee3913748be0c25dc878a5733cd18ee7ee5f2b2432b56118138cca2b
Opcode Fuzzy Hash: 245cc1854b0a76b1e9c9794d54a8988a620f117b88c4776061baa9680a608b5f
Instruction Fuzzy Hash: 4F5138B7F116250BF3484879CD683B226439BD1314F2F82788A996BBC9DC7E5D0A5384

Function 0026C1DB Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17ac4826bdd30d5706c7c2747cffc17ae67f77d29595f64d5883908949a8750
Instruction ID: f2005c1795c217047c4d37bcdf7409c0e653a6661a8d25dca968ff6d78e792b6
Opcode Fuzzy Hash: b17ac4826bdd30d5706c7c2747cffc17ae67f77d29595f64d5883908949a8750
Instruction Fuzzy Hash: CC518AB3E012258BF3544E69DC94361B792EB95324F3F813C8E985B3C1DA3E6D199788

Function 00197380 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3ac05aaf62c60878a92cc686f3156c319740380cb2414840d3c4164a7ef5e031
Instruction ID: c460561b17f7c1ba5e243cd7694959e7ae4c2a43e2674b0dc7294843cc2ff03e
Opcode Fuzzy Hash: 3ac05aaf62c60878a92cc686f3156c319740380cb2414840d3c4164a7ef5e031
Instruction Fuzzy Hash: 2A418976618300DFD7288B98C884ABE7B93FBD5320F6D552DC4C527A62CB70588187C7

Function 002581DB Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b8f008c712d879da54fc6a708797ab47c8af9e3f96e052076af026310ce9b6
Instruction ID: 5a2b5599f776a2a745a6d5242d843951d6c17e2ed95b883e45c28ec8547c1743
Opcode Fuzzy Hash: c7b8f008c712d879da54fc6a708797ab47c8af9e3f96e052076af026310ce9b6
Instruction Fuzzy Hash: 6B51AFB3F116204BF3544929CC983A17693EBD5315F2F81788E98AB3C1ED7E5D1A9388

Function 00276352 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd20fbfdc5ccf826fa8f35d4981c2ce5585e510014dbf2b601f81af800be10de
Instruction ID: 7e1ae7e9a6b78710f2d38af2cb9e9e9bd08b89f952cd89ddc0c63f5232d28eb3
Opcode Fuzzy Hash: fd20fbfdc5ccf826fa8f35d4981c2ce5585e510014dbf2b601f81af800be10de
Instruction Fuzzy Hash: 7B516CB3F516254BF3448968CC983A23283EBD5321F2F82788E489B7C9DD7D9D0A5384

Function 002DE55F Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524a7ac9f7919ef77d6f85071bc904d1af5988ff32612d2e789d3f7f2df249d7
Instruction ID: 5ac9d385338ccbc314cc8b08c9185c2304c4564e6d6c5d542dc9c9d67b82f555
Opcode Fuzzy Hash: 524a7ac9f7919ef77d6f85071bc904d1af5988ff32612d2e789d3f7f2df249d7
Instruction Fuzzy Hash: C84152B3F115214BF3548929DCA83A262839BD9324F2F8279CE9D5B3C6DDBE5C455380

Function 002BA174 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe434fa9e9d9bd966663d40d8ab46bca07eccec2cf6c4bff0d73c6ddbceadad0
Instruction ID: 2869e2b6c8789de0b3148bb4f4b2f0e3578fa8722fa87a52212900feaf8fdf50
Opcode Fuzzy Hash: fe434fa9e9d9bd966663d40d8ab46bca07eccec2cf6c4bff0d73c6ddbceadad0
Instruction Fuzzy Hash: 2A416FB3F216210BF3544879CD983A26583E795310F2F8678CE8CAB7C6D87E9D494384

Function 0020D04B Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2235f85d155aa52f0ad6fe541e9fc7ee55c1d05a5bf9536919a86bc77af82988
Instruction ID: 9c5c324e53c880c860e11ce0183c7750f4f636d559b84947e2dceb7a9b216e18
Opcode Fuzzy Hash: 2235f85d155aa52f0ad6fe541e9fc7ee55c1d05a5bf9536919a86bc77af82988
Instruction Fuzzy Hash: 464159A7F125200BF3488839DD593626583DBD1315F2FC2398A99ABBCDDC7E9D0A0384

Function 0028C40A Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9c6dcce9159c3e100f4c01be88fd69425fb4b2baafa32bddf4eb8fd6a61ffe
Instruction ID: 786bc49400cd63105034fd69541d5c930a103eda8d5f4264972c616a14824714
Opcode Fuzzy Hash: 2d9c6dcce9159c3e100f4c01be88fd69425fb4b2baafa32bddf4eb8fd6a61ffe
Instruction Fuzzy Hash: 07318F73F112254BF35489A9CD983A26683EBD5314F2F8139CF899B7C5D8BE9C065384

Function 002A3181 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88190ec399232d2c634e269e6d8c7a56f039ed94d4120d9551d80f41c1c5b9e
Instruction ID: aa81f1ef55823f977b8c0390833ada2cb241afb80a4fcf4bb5db3a4f563a5266
Opcode Fuzzy Hash: a88190ec399232d2c634e269e6d8c7a56f039ed94d4120d9551d80f41c1c5b9e
Instruction Fuzzy Hash: C9315AB3F101254BF3644D69DC94362A683EBE5310F2F82788A886B7C9DD7E5C0A5384

Function 0027C22D Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fbc8b87aa9456b62834f84fa3c191c017828e9c99d04d795f8f65eecd9652b
Instruction ID: 80aeacc6bf781ebb0e047e5ddde83b4fdd09c87184b736a2703ef41fdb77b3b4
Opcode Fuzzy Hash: e1fbc8b87aa9456b62834f84fa3c191c017828e9c99d04d795f8f65eecd9652b
Instruction Fuzzy Hash: 7E316DB3F016204BF3148E2ADC94362B393AB95710F1F81788E886B7C5D97E5C069384

Function 001FC3C2 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435e7eac5745be77635de018905b1a66425d2e1b850a6e2348dce1362c2003ea
Instruction ID: 23ef881260b34f512682bbdbfb3f16e3a14f28e1c90916d914e7c32f56573e75
Opcode Fuzzy Hash: 435e7eac5745be77635de018905b1a66425d2e1b850a6e2348dce1362c2003ea
Instruction Fuzzy Hash: 563145A7F2162107F7A84878DD69366558397E4324F2F82388F89A77C2E87D4C0502C8

Function 0025E553 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9eb1a45546019f180777d647622b2551067bda9bbcc23e295b6d45d64c4df8b
Instruction ID: e9a5a1d699e9f373fae44e2ea199afa00c80c93b5752799602f7df9dc908e3dd
Opcode Fuzzy Hash: d9eb1a45546019f180777d647622b2551067bda9bbcc23e295b6d45d64c4df8b
Instruction Fuzzy Hash: B0319FA3F115254BF3448D39CC583627293DBC5325F3F82788958ABBC9D93EAD0A5384

Function 002CC0D7 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2b68b1b824674eed8aa5c6447a530ab4f62a41c66128ca88d01b6727b6481f
Instruction ID: 59da11909a9e9794714ef44676a1c083b1b8e1af8ee99fb7f846e50bf60e22a9
Opcode Fuzzy Hash: 4c2b68b1b824674eed8aa5c6447a530ab4f62a41c66128ca88d01b6727b6481f
Instruction Fuzzy Hash: D63148F7F1162107F35844A9DD69362A182D7D5314F2F82388F69AB7C6EC7E5C0502C4

Function 003140A2 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694f3561548390412d6a0e2481985d329dcc6207a42ab55bc8b96592bde2d143
Instruction ID: ecd7794b41f97e0be9365caf0a79245f284045902570260196c32a6306425576
Opcode Fuzzy Hash: 694f3561548390412d6a0e2481985d329dcc6207a42ab55bc8b96592bde2d143
Instruction Fuzzy Hash: 11314AB3F5122547F394487ACD483A265839BC5321F2F82388E6CAB7C5DCBE8D4A52C4

Function 0024D13E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ea67f96899617485bc009dbed89f59ba1a4ff2a625fa34d8d812ec02a595a7
Instruction ID: 7629ac0eed80aa47e33108624c7b158b5635c86113dd6139c92fcef32d35fc5e
Opcode Fuzzy Hash: 53ea67f96899617485bc009dbed89f59ba1a4ff2a625fa34d8d812ec02a595a7
Instruction Fuzzy Hash: C9313BB3F6152107F7584879CD983A6658397D4320F2F82788F5C6BAC9DCBD4C4A1294

Function 0028E398 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22dc7e4cbf45f2d6b2d5583fe913492c9b72c48e95984d832950ec786ad7c624
Instruction ID: 4124f76e5a3403d82a8e506f062c39d75039980150acbc81e3c8a9eedc363cca
Opcode Fuzzy Hash: 22dc7e4cbf45f2d6b2d5583fe913492c9b72c48e95984d832950ec786ad7c624
Instruction Fuzzy Hash: 25313BB3E515314BF35488B5CD58362A982A795320F2F83798F6DBB6C5DCBE5C0A42C4

Function 0026C07C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118cd7b789473f97aef52895d35e1daab11f71e78fc5e1730aae1ebc90a48151
Instruction ID: 95569a9245d133a9743fbec871dda6ecb37f0a9a7966c342e148c23e483b49e9
Opcode Fuzzy Hash: 118cd7b789473f97aef52895d35e1daab11f71e78fc5e1730aae1ebc90a48151
Instruction Fuzzy Hash: 26313DB7F0163147F3548D29CCA4366B292EB95314F2F82798E986B7C4E97E6C4953C0

Function 0030426B Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49292b9598bd9166db0166493cf4a8bc983907d95357cb1663b44e079d38244
Instruction ID: a57bbb3094b1d58e221164f6e83954651b94e6fef0b3c8fcb736a1eb511d6544
Opcode Fuzzy Hash: f49292b9598bd9166db0166493cf4a8bc983907d95357cb1663b44e079d38244
Instruction Fuzzy Hash: C531E7F7F1162507F3504839DD99362658397E5324F2F82798E68ABBCAD87E9C0A1380

Function 0022D07E Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea8409f74cd939a4c924d36b9ff049e873fbe7966c2b55e1a69fb1c40a8b72c
Instruction ID: 21b69764fbc75ff3ff894926e239ed1a3b563908e5e54c32b0925eb9e4c8e06c
Opcode Fuzzy Hash: 7ea8409f74cd939a4c924d36b9ff049e873fbe7966c2b55e1a69fb1c40a8b72c
Instruction Fuzzy Hash: 492134B3F1162507F3940879DC98362658397D5324F2F82798E586B7CADCBE9C064388

Function 001B5450 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 75fac9c4cc6c1c8a887b072b097bb97a220aed2cff7c91d4cea4cf85711e6e9b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: DF11AC336055D40EC3168E3C84106B57FA31AA3635F6943D9F4B89B1D6E7228DCB8355

Function 001DC06C Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b60f540e209c4f41e40f583bbeb3c9982200dc48fba9fa2b9684d3d2358f1a
Instruction ID: d7dcfe8e53344a09ce71ade37b024be169ba9f7ca2b4e96cf68b7f14d64386b5
Opcode Fuzzy Hash: d4b60f540e209c4f41e40f583bbeb3c9982200dc48fba9fa2b9684d3d2358f1a
Instruction Fuzzy Hash: 97F024B33182424FAB084E3EEED86229ADBE7D4B6473B463AD000C7399DAB444079111

Function 001A3086 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109473606.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2109458579.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109473606.00000000001C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109516390.00000000001D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109530733.00000000001E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109624981.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109640427.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.000000000034D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109658270.0000000000358000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109690712.0000000000360000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109704076.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109723651.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109736510.0000000000376000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109749409.0000000000377000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109761978.0000000000378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109778029.0000000000388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109791400.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109804585.000000000038B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109822178.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109839915.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109854268.00000000003BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109867405.00000000003C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109879418.00000000003C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109891317.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109905649.00000000003C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109920055.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109932719.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109946179.00000000003E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109962924.00000000003ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109975777.00000000003EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109990359.00000000003EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110004560.00000000003F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110018341.00000000003F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110034591.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110048569.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110068065.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110081432.0000000000433000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110113702.000000000045C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110127752.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110142110.0000000000464000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110170941.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2110184094.0000000000473000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_LopCYSStr3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496d977c720f1bf66cb861758b1630914e5ba51bf9b4ce2b210a0bf414d0b5c6
Instruction ID: d40ba74617b8069e70fe9c5c1ffd643e9dd211c2ac99e6540ba192e767307170
Opcode Fuzzy Hash: 496d977c720f1bf66cb861758b1630914e5ba51bf9b4ce2b210a0bf414d0b5c6
Instruction Fuzzy Hash: FCE0E575C11110AFDF047B10FD52A98BEF2AB62307B4A1070E408A3632FF3298AB9B55

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LopCYSStr3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
LopCYSStr3.exe

Function 0018ACF0 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Function 00188850 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Function 001BC1F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 001BC767 Relevance: 1.3, Strings: 1, Instructions: 99
COMMON

Function 001BAAA0 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Function 001BAA80 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON